Question

A financial services company operates a multi-account AWS Organization with a centralized inspection VPC that hosts AWS Network Firewall. The security governance team must guarantee that every stateful rule group deployed across all firewall policies in every member account enforces a mandatory drop rule for known malicious domains, and they must be automatically alerted whenever a firewall policy is created or modified in a way that removes this baseline protection. The team wants a scalable, organization-wide approach that centralizes rule management while continuously auditing compliance. Which combination BEST meets these requirements?

Accepted Answer

Use AWS Firewall Manager with a Network Firewall policy to centrally deploy and enforce the baseline stateful rule group across all accounts, and rely on Firewall Manager's non-compliance reporting plus AWS Config rules to detect and alert on drift.

Answer

Deploy the stateful rule group manually in each member account's firewall policy and use Amazon GuardDuty to detect when the malicious-domain drop rule is removed.

Answer

Create a CloudFormation StackSet that provisions identical Network Firewall policies in every account and enable termination protection to prevent any modification of the rule groups.

Answer

Share a single centralized Network Firewall rule group via AWS RAM to all accounts and use VPC Flow Logs to confirm that malicious-domain traffic is being dropped.