Welcome to Solving
with AWS Solutions.
Your deep dive into reference
architectures built by AWS that
are ready to deploy instantly
in the cloud.
I'm Ashley, and today I'm
joined by Lilat to tell us
about the AWS Firewall Manager
Automations for
AWS organisation solution.
Customers often find it
difficult and time-consuming to
have a consistent security
posture across their
AWS organisation.
This solution is great for
customers looking to
standardize security while
making it easy to get started
with AWS Firewall Manager.
Awesome.
Let's take a look.
All right Lilat.
Show me how we get started.
Sure.
The great place to start is
the landing page.
You're provided
an implementation guide,
basic information about the
solution and the
architecture diagram, which we
will dive deep into.
You can also look at the
source code, if you
would like.
Great, so you mentioned the
architecture diagram, can we
look at that?
Let me walk you through that.
So if you are a first time
Firewall Manager user,
we provide you a prerequisite
template that will help you set
up a dedicated admin for your
Firewall Manager service.
The resources that you see here
are going to be deployed by
the primary stack.
Nothing really changes in your
environment until you identify
and provide a list of
organizational units or
specific regions, or if you
want to provide a certain tag
values to us.
Once you enter the organization
unit into the parameter store,
the change will be captured by
the EventBridge rule,
which will invoke
the Lambda function.
This Lambda function here is
going to get the default policy
from the S3 bucket and going to
make Firewall Manager API calls
to deploy the security policies
for you, as well as store the
metadata into DynamoDB table.
OK, I'm looking at the
compliance
report generator here.
It looks like this solution
creates a time based event and
then invokes the Lambda
function and creates the
compliance report and
stored in S3.
That's correct.
Wonderful.
All right.
So let's
talk about customization.
You know, for organizations,
it's essential to be able to
make this work for
their needs.
Show me how we can
customize these policies.
Sure let me walk you through
where we stored
the default policy.
So here's the S3 bucket where
we stored the manifest file.
Let me switch to
the default policy.
So here you can see that there
are six or seven kinds of
security policies that
you can deploy.
You can modify them.
You can modify any properties.
And if you want to just remove
one specific security
policy type, you can just get
rid of that and that will that
will update your
security policy posture.
Let me take you to the
parameter store and
systems manager console.
This is where we have
provided the OUs.
If you wish to delete the
security policies, you can just
replace these values with the
keyword delete, and all the
policies will be
deleted for you.
If you wish to deploy security
policies to
very specific regions, you can
also provide a list of regions
here as well.
In the Firewall Manager console
here you can see the global
default policy was deployed
after we added
the organization unit.
After we added the regions,
we deployed the regional
security policies in the
specific regions that we have
entered in the
parameter store.
Let me walk you through one of
the security policies
for security groups.
Here you can see you can easily
identify what does this policy
do just by looking at
the policy detail.
We are monitoring if the
security group allow
an ALL protocol.
And yes, we have identified one
of those accounts where a
security group allows that and
it's easily it's very easy for
us to identify what what
security group is that?
And we can go and fix that.
We by default disable the
automatic remediation because
we don't want to
modify your environment.
So if you wish to enable it,
you can do so as well.
All right.
So if I want to apply this for
my business,
for my organization, what kind
of value does it have?
So the first thing it saves
you time, right?
And second, it automates the
deployment of your security
policies to protect your
web applications, block bad DNS
queries and audit
your security groups.
All right.
Saves time simplifies.
Sounds great.
Thanks so much for explaining
it to me.
You're welcome.
Well, there you have it.
The AWS Firewall Manager
Automations for
AWS Organizations Solution.
Visit the AWS website
to learn more.
Thanks for watching.
See you soon!