Lecture 240: AWS Firewall Manager
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：07:27
- 来源：Udemy Lecture 42734240
- Slide 数量：5
- 画面切换：02:14、02:56、03:57、05:26
扫描说明
逐条读取了 Transcript 面板中的 98 条英文 cue，并按播放器进度同步全长约 07:27 的视频。依据 Central Governance、Prerequisites、Policy/Remediation、Coverage/Integration、Service Selection 划分为 5 个小节。播放器出现购券插屏后已重载课程项，5 张最终截图均来自真实 Slide，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Firewall Manager 把多账号 Firewall Policy 变成 Organizations 级统一治理
时间范围：00:00–02:14
总结 / Summary
中文
少量 AWS Account 可逐个配置 Security Group、WAF、Shield Advanced、Network Firewall 或第三方 Appliance；当 Organization 有数百账号时，手工方式无法保持一致。AWS Firewall Manager（FMS）是 Security Management/Governance Tool，在 AWS Organizations 范围内统一定义、部署和维护 Policy。它可管理 WAF、Shield Advanced、VPC Security Group、AWS Network Firewall、Route 53 Resolver DNS Firewall 等规则；新 Account 加入受管 Scope 后可自动纳入 Policy。它还提供跨账号的 Compliance 与 DDoS Monitoring 视图。
English
Security groups, WAF, Shield Advanced, Network Firewall, or third-party appliances can be configured account by account at small scale, but that approach cannot maintain consistency across hundreds of accounts. AWS Firewall Manager is a security-management and governance tool that centrally defines, deploys, and maintains policy across AWS Organizations. It manages rules for WAF, Shield Advanced, VPC security groups, AWS Network Firewall, and Route 53 Resolver DNS Firewall. New accounts entering a managed scope can inherit policy automatically, while centralized views report compliance and DDoS activity across accounts.
Transcript
00:00 Hi.
00:01 So in this section so far we talked about different firewalls starting with security group network ACLs,
00:08 then AWS Network firewall, Web Application Firewall, and then AWS Shield and Shield Advance, and
00:16 also Gateway Load Balancer through which you can use third party firewalls.
00:21 So it works well when you have, say, 1 or 2 AWS accounts where you can go and configure these firewalls.
00:27 But imagine a situation where there are hundreds of AWS accounts, and then you have to have consistent
00:33 network security policies or firewalls deployed across those AWS accounts.
00:39 And as you might have guessed, in that case, you need a centralized service which can manage this
00:45 firewall across all these accounts.
00:47 And that's where AWS Firewall Manager is used.
00:50 So AWS Firewall Manager is a security management tool which simplifies the security, administration
00:58 and maintenance tasks across AWS accounts and resources.
01:03 When I say resources, that means which AWS resource you are protecting.
01:07 Uh, using the firewall.
01:09 For example, security groups of EC2 instances or network load balancer or particular route 53 hosted
01:16 zones or particular instance behind the network firewall.
01:20 Likewise.
01:22 So AWS Firewall Manager can manage the rules for AWS WAF shield, advanced VPC Security Groups, Network
01:29 Firewall, and route 53 resolver DNS firewall.
01:34 Now it works at AWS organization level.
01:36 That means if you are adding new AWS account to AWS organization, then all the policies are automatically
01:44 applied to that new account as well.
01:47 So if you are aware of the concept of AWS landing zone, this is kind of goes well with the landing
01:53 zone concept, where you can centrally manage the firewall policies through the AWS Firewall Manager.
02:01 And additionally, Firewall Manager also provides you the centralized dashboard for monitoring the DDoS
02:08 attacks.
02:08 Now again, this is across all your accounts within the AWS organization.
2. Organizations Full Features、AWS Config 与 RAM 构成治理基础
时间范围：02:14–02:56
总结 / Summary
中文
本讲给出的基础 Prerequisite 是启用 AWS Organizations 的 All Features、启用 AWS Config，并开启 AWS Resource Access Manager（RAM）的 Organization Sharing。Organizations 提供账号与 OU Scope；Config 记录 Resource Inventory 和 Configuration Change，例如 Security Group Rule 被修改；RAM 支持跨账号共享相关 Resource。实际还需指定 Firewall Manager Administrator Account，并按 Policy Type 满足额外权限、Service-linked Role、Region 与 Config Recorder 要求。
English
The lecture's foundational prerequisites are AWS Organizations with all features, AWS Config, and organization-wide sharing through AWS Resource Access Manager. Organizations supplies account and OU scope. Config records resource inventory and configuration changes, such as a security-group rule modification. RAM enables cross-account sharing of relevant resources. A real deployment also designates a Firewall Manager administrator account and satisfies policy-type-specific permissions, service-linked roles, regional setup, and Config-recorder requirements.
Transcript
02:14 So in order to use firewall manager, you have to do some prerequisites.
02:20 For example, you have to enable the AWS organization.
02:23 That is all features of AWS organization.
02:25 You have to enable the AWS config service, which is basically, you know, inventory of your all AWS
02:31 resources, and it tracks the changes to your AWS resources.
02:36 For example, if you change the security group, it is recorded in AWS Config service.
02:41 So you have to enable this service as well.
02:43 And then you have to enable the sharing of AWS resources across your AWS organization.
02:50 And that is done through AWS Resource Access Manager.
02:54 That is Ram.
02:55 Okay.
3. Policy = Rule + Account/Resource Scope + Violation Action，可选择 Detect 或 Auto-remediate
时间范围：02:56–03:57
总结 / Summary
中文
FMS Policy 先描述要部署或审计的 Firewall/Rule，再用 Organization、OU、Account、Resource Type、Tag 等定义 Scope，最后选择对 Noncompliance 的 Action。示例 Rule 禁止 Security Group 将 TCP 22 对 0.0.0.0/0 开放：FMS 发现违规后可以只产生 Finding/Notification，也可以自动移除或修复违规 Rule。Auto-remediation 会直接改变 Member Account Resource，启用前应通过 Audit-only、Exception、Change Window 与 Rollback 设计验证影响。
English
An FMS policy describes the firewall or rule to deploy or audit, scopes it by organization, OU, account, resource type, tags, or related selectors, and chooses an action for noncompliance. In the example, no security group may expose TCP 22 to 0.0.0.0/0. FMS can report the violation as a finding or notification, or automatically remove or correct the offending rule. Because auto-remediation changes member-account resources, it should be introduced with audit-only evaluation, exceptions, change windows, and rollback planning.
Transcript
02:56 So once you have the AWS Firewall Manager, then what you do, you write the policies and rules.
03:02 In this.
03:03 You define that what kind of firewall I want to deploy in which all AWS accounts and for which all AWS
03:10 resources.
03:11 So you define the scope and then once scope is defined, you can also define the actions if there are
03:18 any compliance violations.
03:20 For example, if you define the rules, say none of the security group in your AWS account should have
03:27 port 22 open to the internet.
03:29 So if you now create a new security group which has the port 22 open, then firewall manager will detect
03:36 that and one it will trigger the notification saying that there is a compliance violation.
03:42 And second, it can automatically remove that rule from the security group.
03:47 Now it really depends on you whether you want to implement the automated remediation or not or otherwise.
03:53 You can definitely have the detection mechanism in place.
4. 统一覆盖 AWS 与 Marketplace Firewall，并把 Finding 汇聚到 Security Hub
时间范围：03:57–05:26
总结 / Summary
中文
同一治理面可覆盖 VPC Security Group、AWS WAF、Shield Advanced、AWS Network Firewall、Route 53 Resolver DNS Firewall，并可对支持的 Marketplace Next-generation Firewall（如 Palo Alto、FortiGate）做集中管理。FMS 检测到 Policy Violation 或 Attack Finding 后可把结果送到 AWS Security Hub；Security Hub 再与 Event-driven Automation 或 Ticketing System（例如 Jira）集成，形成中央 Dashboard、Assignment 与 Remediation Workflow。FMS 管理的是 Policy/Compliance，不取代真正检查或阻断 Packet 的 Firewall Engine。
English
One governance plane can cover VPC security groups, AWS WAF, Shield Advanced, AWS Network Firewall, and Route 53 Resolver DNS Firewall, as well as supported Marketplace next-generation firewalls such as Palo Alto or FortiGate. FMS can send policy violations or attack findings to AWS Security Hub, which can integrate with event-driven automation or ticketing systems such as Jira for centralized dashboards, assignment, and remediation workflows. FMS manages policy and compliance; it does not replace the firewall engine that actually inspects or blocks packets.
Transcript
03:57 So this is how Firewall Manager works okay.
04:01 So again with respect to the services that it supports.
04:04 So it supports VPC security Group, Web Application Firewall, AWS shield Advanced Network Firewall
04:11 and AWS route 53 resolver DNS firewall.
04:15 Now we will see resolver DNS firewall in the route 53 section.
04:19 But essentially that means network firewall can manage all the rules and policy for all these AWS services.
04:27 Now additionally, you can also use third party firewall.
04:31 For example, you can subscribe to AWS marketplace and you will see a lot of firewall options in there.
04:37 So if you want to manage, say, Palo Alto Cloud, Next Generation firewall or Fortigate Cloud Native
04:43 firewall, then they can also be managed centrally using the firewall manager.
04:49 And as I said, firewall manager can detect the any violation to the compliances.
04:55 And it can also perform the action to remediate that.
04:58 So all this can be recorded in AWS Security Hub through the notifications from the firewall manager.
05:05 And then in the security hub you can further integrate with your ticketing system.
05:10 For example, you will automatically create a JIRA ticket or you can centrally, you know, view all
05:16 the violations in the dashboard that Security Hub provides.
05:20 So this is how you typically work with AWS Firewall Manager.
5. 选型先看 Protection Layer，再决定是否需要跨账号 Central Governance
时间范围：05:26–07:27
总结 / Summary
中文
Web Application 的 Layer-7 Attack 选 AWS WAF；DDoS Protection 与 AWS Response Support 选 Shield Advanced；VPC 内外流量需要 AWS-managed Stateful IPS/IDS 选 AWS Network Firewall；需要 Palo Alto、Fortinet、Check Point 等第三方 Inspection Appliance 的 Transparent Insertion 选 Gateway Load Balancer。若需求是在 Organization 中对上述一个或多个 Control 统一部署、审计和 Remediate，则再加 Firewall Manager。它们不是互斥替代品：Data-plane Protection Service 与 Management-plane Governance Service 可以组合使用。
English
Choose AWS WAF for Layer-7 web-application attacks, Shield Advanced for DDoS protection with AWS response support, AWS Network Firewall for an AWS-managed stateful IPS or IDS path around VPC traffic, and Gateway Load Balancer for transparent insertion of third-party appliances such as Palo Alto, Fortinet, or Check Point. Add Firewall Manager when an organization must deploy, audit, and remediate one or more of those controls centrally. These are not mutually exclusive: data-plane protection services and a management-plane governance service are designed to work together.
Transcript
05:26 Right.
05:26 So in this section we talked about a lot of things.
05:29 And many a times it is overwhelming with respect to all the AWS security services out there.
05:36 And we haven't still talked about few of the other AWS services.
05:40 But often the question comes when to use what.
05:43 So I just try to, you know, put some guidelines here.
05:46 So for example, if you want to have a quick and easy way to deploy the firewall for protecting the
05:52 web application at layer seven, then you should rather use AWS Web Application Firewall, that is WAF.
05:58 Now the keyword here is easy and quick.
06:01 And layer seven attacks, right?
06:04 Similarly, if you want to do that for the DDoS attacks, you might have guessed it should be AWS Shield
06:10 Advance.
06:11 And if you need more sophisticated firewall for your VPCs for IPS and IDs systems, then you should
06:19 use AWS Network Firewall.
06:21 And if you need any third party IPS and IDs systems so that you can bring in into your VPC and you can
06:30 route your traffic through those third party firewalls, then you should be using AWS Gateway Load Balancer.
06:37 And if you want to manage everything at one place centrally, then you should be using AWS Firewall
06:45 Manager.
06:45 So Firewall manager itself doesn't provide you the firewall.
06:49 It is just a management of firewall, which means all these AWS services that you see are not mutually
06:56 exclusive, but you can typically use them together in different architecture because the purpose is
07:04 different.
07:04 Right.
07:05 So I hope this short summary also helps you build that mental model around different AWS network security
07:11 services.
07:12 And you should be able to.
07:14 Use right answer in your exam based on what we covered in this section.
07:19 Right.
07:19 So with that we'll stop for this lecture and let's see what's next there for us.
07:24 Thanks for watching and stay tuned.
整讲总结 / Overall Summary
中文
AWS Firewall Manager 是多账号 Security Governance Plane，而不是独立 Firewall。它依托 Organizations、Config、RAM 与管理员账号，把 WAF、Shield Advanced、Security Group、Network Firewall、DNS Firewall 及支持的第三方 Firewall Policy 推送到指定 Scope，持续检测 Compliance，并可 Notification 或 Auto-remediate，再通过 Security Hub/Ticketing 汇聚运营流程。
English
AWS Firewall Manager is a multi-account security-governance plane, not a standalone firewall. Using Organizations, Config, RAM, and an administrator account, it applies WAF, Shield Advanced, security-group, Network Firewall, DNS Firewall, and supported third-party firewall policies to selected scopes, continuously evaluates compliance, optionally notifies or auto-remediates, and feeds operational workflows through Security Hub and ticketing integrations.
返回顶部 ↑