So now let's talk
about the AWS Firewall Manager.
So this is a service to manage all the firewall rules
in all accounts of an AWS organization.
So the idea is that you can manage rules
across many, many accounts at the same time.
So you can set a security policy,
and a security policy is a common set of security rules.
And so this could be Web Application Firewall rules,
so they apply it to the ALB, the API gateways, CloudFronts
and so on.
Or it could be Shield Advanced rules,
so for your ALB, CLB, NLB, the Elastic IP, and CloudFront.
It could be security policy to standardize security groups
for EC2, your Application Load Balancer,
and ENI resources in your VPC.
And it could be, as well,
rules for your AWS Network Firewall at the VPC level.
So this is something we haven't seen yet
or your Amazon Route 53 Resolver DNS Firewall.
So the idea is that Firewall Manager allows you
to manage all your firewalls in one place.
The policies are created at the region level, okay?
And then they are applied to all the accounts
of your organization.
And on top of it,
if somehow in your organization, for example,
you create a WAF rule for an Application Load Balancer,
and somehow there's a new Application Load Balancer
being created,
then automatically the Firewall Manager
is going to apply the same rule
to this newly created ALB.
That's a feature of Firewall Manager.
So you may ask yourself,
"Well, what is the difference between WAF
and Firewall Manager and Shield?"
Well, WAF, Shield, and Firewall Manager
are used together for comprehensive protection
of your accounts.
So first you define your Web ACL rules in WAF.
And in case you need one-time protection,
then WAF is going to be the right choice for you.
But if you want to use WAF across multiple accounts
and accelerate WAF configuration
and automate the protection of new resources,
then you would manage your WAF rules
within Firewall Manager.
And Firewall Manager will just apply
all these rules to all your accounts
and all your resources automatically.
So now we also have Shield Advanced
to help you get protected against DDoS attacks.
And it has additional features on top of WAF
such as a dedicated support
from the Shield Response Team, SRT,
advanced reporting,
and also, it can automatically create WAF rules for you.
And if you're prone to frequent DDoS attacks,
then you should definitely consider
purchasing Shield Advanced.
And so Firewall Manager
can also help you deploy Shield Advanced
across all your accounts
So hopefully the distinction is pretty clear for you now.
I hope you liked this lecture,
and I will see you in the next lecture.