Firewall Manager in Shared VPC Environments

1. AWS Firewall Manager Overview

AWS Firewall Manager (FMS) is a centralized security policy enforcement service integrated with AWS Organizations. It allows security administrators to define firewall, WAF, and network protection policies in a single account and automatically apply them across member accounts.

When used with Shared VPCs, FMS integrates directly with:

• AWS Network Firewall (for centralized network-layer protection)
• AWS WAF (for application-layer protection)
• Security Group policies (for instance-level enforcement)
• Route 53 Resolver DNS Firewall (for domain-based filtering)

2. How Firewall Manager Operates in a Shared VPC

Shared VPC Structure Recap

• The Host Account owns the VPC, subnets, NACLs, and routing tables.
• Participant Accounts deploy workloads (EC2, ECS tasks, ENIs) in the shared subnets.
• Firewall Manager Admin Account manages organization-wide policies.

Firewall Manager’s Scope in Shared VPCs

• FMS operates at the organization level (across accounts), not just per VPC.
• For Shared VPCs, FMS applies policies directly to the Host Account’s VPC since it owns the network layer.
• It automatically identifies and applies security group compliance or Network Firewall deployments to the shared subnets.
• Participant accounts cannot override enforced SG, WAF, or firewall rules defined by FMS.

Diagram: Firewall Manager centrally enforces SG, Network Firewall, and DNS Firewall across shared subnets and participant workloads.

3. Security Aspects Controlled by Firewall Manager

4. Example: Shared VPC Policy Application Flow

1. Security Admin in the Firewall Manager administrator account defines a Network Firewall policy for the Shared VPC’s subnets.
2. FMS automatically deploys firewall endpoints in the host account’s subnets (e.g., Inspection VPC or shared subnet).
3. Security Group Policy is enforced so that participant workloads cannot create SGs with unrestricted ingress/egress.
4. Traffic from participant EC2 instances is routed through the centralized Network Firewall (for east-west and north-south inspection).
5. Compliance violations (e.g., missing SG association) appear in the FMS dashboard for remediation.

5. Best Practices for FMS in Shared VPCs

• Designate a dedicated Security Administrator Account with FMS admin privileges.
• Deploy Network Firewall in dedicated inspection subnets within the host account.
• Apply security group policies that define baseline ingress/egress templates for all workloads.
• Enable auto-remediation for SG and WAF noncompliance to reduce drift.
• Integrate FMS with Security Hub and CloudWatch for unified visibility and alerting.
• Regularly audit RAM sharing configuration to ensure correct subnet and SG exposure.