How to enforce a security baseline for an AWS WAF ACL across your organization using AWS Firewall Manager

This article discusses how to enforce a security baseline for AWS WAF access control lists (ACLs) across an organization using AWS Firewall Manager.

Specifically, the article covers:

• Centrally managing firewall policies using AWS Firewall Manager and delegating administrators
• Creating a Firewall Manager policy as a security baseline with mandatory first and last rule groups, and allowing a custom middle rule group for specific application needs
• Defining the scope of the policy across accounts and resources
• Examples of rules to include in the first (e.g., IP reputation lists), middle (e.g., rate limits, OWASP rules), and last (e.g., allowed lists) rule groups
• Recommended approach for testing and tuning the WAF rules before enabling in production
• Cleanup steps to remove unnecessary policies and resources