Hi everyone! I’ve been lurking for a while and finally decided to post. I’m Linda, and I’m relatively new to managing security at this scale, so please bear with me if I’m over-explaining or missing something obvious! 😅
Our team has been using AWS for our SaaS platform, and with our recent growth, we’ve spun up several AWS accounts for different departments (like marketing, support, and the main application). We’re now at the point where we need a consistent Web Application Firewall (WAF) policy across all of them, especially for our customer-facing apps. I kept hearing about AWS Firewall Manager and StackSets as the way to handle this, but the documentation felt a bit like jumping into the deep end.
I wanted to share the step-by-step process I followed, in case it helps anyone else who’s feeling a bit overwhelmed. I’d also love for the more experienced folks here to weigh in and tell me if I took a wrong turn anywhere!
First, I made sure we had AWS Organizations set up and that all our target accounts were in the organization. Then, I enabled AWS Firewall Manager in our primary security account. This part required setting up an AWS Config rule for resource compliance, which was a new concept for me—it felt a bit like setting the ground rules before you can start building.
The trickiest part was designing the actual WAF rule groups. We started simple: one rule to block common SQL injection patterns and another to rate-limit requests from a single IP. Creating these in the primary account felt straightforward, but figuring out the scope for the Firewall Manager policy—like whether to apply it to all CloudFront distributions, all Application Load Balancers, or both—took some trial and error.
Deploying with StackSets felt like magic once it worked! I created a stack set with the WAF policy and linked it to our organizational units. Watching it propagate to all the accounts was a huge relief. But I’m left with a few nagging questions:
* How do you all handle updates? If I need to add a new rule to the web ACL, do I just update the master policy in Firewall Manager and it propagates automatically, or is there a better way?
* We have a couple of development accounts where we might need to temporarily disable a rule for testing. Is there a clean way to handle exceptions without creating separate policies for every account?
* The costs seem a bit opaque. Beyond the base WAF and Shield costs, are there any hidden charges with Firewall Manager or Config that I should be watching out for?
Any pro-tips or lessons learned from your own deployments would be so, so appreciated. I feel like I’ve got the basics working, but I’m sure there are nuances I’ve missed.
Thanks!