Step 3: Create and apply a common security group policy
After completing the prerequisites, you create an AWS Firewall Manager common security group policy. A common security group policy provides a centrally controlled security group for your entire AWS organization. It also defines the AWS accounts and resources that the security group applies to. In addition to common security group policies, Firewall Manager supports content audit security group policies, to manage the security group rules in use in your organization, and usage audit security group policies, to manage unused and redundant security groups. For more information, see Security group policies.
For this tutorial, you create a common security group policy and set its action to not automatically remediate. This allows you to see what effect the policy would have without making changes to your AWS organization.
To create a Firewall Manager common security group policy (console)
-
Sign in to the AWS Management Console using your Firewall Manager administrator account, and then open the Firewall Manager console at https://console.aws.amazon.com/wafv2/fmsv2
. For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites. Note
For information about setting up a Firewall Manager administrator account, see AWS Firewall Manager prerequisites.
-
In the navigation pane, choose Security policies.
-
If you have not met the prerequisites, the console displays instructions about how to fix any issues. Follow the instructions, and then return to this step, to create a common security group policy.
-
Choose Create policy.
-
For Policy type, choose Security group.
-
For Security group policy type, choose Common security groups.
-
For Region, choose an AWS Region.
-
Choose Next.
-
For Policy name, enter a descriptive name.
-
Policy rules allow you to choose how the security groups in this policy are applied and maintained. For this tutorial, leave the options unchecked.
-
Choose Add primary security group, select the security group that you created for this tutorial, and choose Add security group.
-
For Policy action, choose Identify resources that don’t comply with the policy rules, but don’t auto remediate.
-
Choose Next.
-
AWS accounts affected by this policy allows you to narrow the scope of your policy by specifying accounts to include or exclude. For this tutorial, choose Include all accounts under my organization.
-
For Resource type, choose one or more types, according to the resources you have defined for your AWS organization.
-
Resources allows you to narrow the scope of your policy by specifying resource tags for inclusion or exclusion. To use tagging, you need to first tag your resources. For more information about tagging your resources, see Working with Tag Editor. For this tutorial, choose Include all resources that match the selected resource type.
-
Choose Next.
-
Review your policy settings. Check to be sure that Policy actions is set to Identify resources that don’t comply with the policy rules, but don’t auto remediate. This allows you to review the changes that your policy would have, without making changes at this time.
-
Choose Create policy.
In the AWS Firewall Manager policies pane, your policy should be listed. It will probably indicate Pending under the accounts headings and it will indicate that Automatic remediation is disabled. The creation of a policy can take several minutes. After the Pending status is replaced with account counts, you can choose the policy name to explore the compliance status of the accounts and resources. For information, see Viewing compliance information for an AWS Firewall Manager policy
-
When you are finished exploring, if you don't want to keep the policy you created for this tutorial, choose the policy name, choose Delete, choose Clean up resources created by this policy., and finally choose Delete.
For more information about Firewall Manager security group policies, see Security group policies.
