AWS Certified Advanced Networking – Specialty (ANS-C01)Network Management and OperationsMedium
A global software-as-a-service (SaaS) provider uses AWS for its multi-tenant application. They have multiple AWS accounts for different environments (dev, staging, prod) and regions. The security team needs to ensure consistent network security policies, such as specific firewall rules for web application traffic, are applied and enforced across all accounts and regions. Manual configuration is prone to errors and policy drift. Which AWS service can be used to centrally manage and automatically deploy these network security policies across all accounts and regions within an AWS Organization?
- AAWS Systems Manager State Manager.
- BAWS Config with Conformance Packs.
- CAWS Security Hub.
- DAWS Firewall Manager.
Show answer & explanationAnswer & explanation
Correct answer: D. AWS Firewall Manager.
AWS Firewall Manager is designed for centralized management and automated deployment of firewall rules across all accounts and resources within an AWS Organization. It can apply WAF rules, Security Group policies, Network ACLs, and AWS Shield Advanced protections consistently across multiple accounts and regions, preventing policy drift and ensuring uniform security posture.
Why the other options are wrong
- A. Systems Manager State Manager manages instance configurations, not centralized network security policies across accounts and regions.
- B. AWS Config with Conformance Packs assesses compliance against security standards but does not automatically *deploy* or *enforce* the policies across multiple accounts and regions in the same way Firewall Manager does.
- C. Security Hub aggregates security findings and provides a dashboard, but it does not deploy or manage security policies itself.
AWS Firewall Manager
A security management service that allows you to centrally configure and manage firewall rules across multiple accounts and applications in AWS Organizations.
- Centralized security policy management.
- Automated deployment across accounts/regions.
- Supports WAF, Security Groups, Network ACLs, Shield Advanced.
Memory trick: Firewall Manager: One shield to rule all your AWS accounts.