An organization manages many accounts with AWS Organizations.
A common WAF policy should apply to existing and newly added resources.
Which AWS service is primarily appropriate?
AWS Firewall Manager centrally manages WAF and other protection policies across accounts and resources in an organization.
Detailed explanation
Manual per-account work does not provide centralized policy management or consistent treatment of new resources.
Manual per-account work does not provide centralized policy management or consistent treatment of new resources.
Firewall Manager applies WAF, Shield Advanced, and related policies across accounts and resources.
Firewall Manager applies WAF, Shield Advanced, and related policies across accounts and resources.
Inspector manages vulnerabilities and exposure; it is not the organization-wide WAF policy service.
Inspector manages vulnerabilities and exposure; it is not the organization-wide WAF policy service.
Artifact provides compliance documents and agreements, not deployable WAF policies.
Artifact provides compliance documents and agreements, not deployable WAF policies.
Check official documentation
Compare the following points with the official documentation.
AWS WAF Developer GuideのAWS Firewall Managerの説明を確認する。
What to confirm
組織のポリシーに基づくWAF保護が既存・新規リソースへ適用される。
Key points
- AWS Firewall Manager
- Multiple accounts
- Organization-wide policy
Notes
- Environment: AWS公式WAF・Firewall Managerドキュメントの確認
- Confirm current security service capabilities and support-plan conditions in the official AWS documentation.
Foundation review
Centralized protection
Firewall Manager reduces account-by-account drift by managing shared policy intent.
New resources
A policy can be evaluated for resources added after the initial rollout.