How to share AWS Network Firewall policies across accounts?

A company has VPCs across 50 AWS accounts and is using AWS Organizations. The company wants to implement web filtering. The requirements for how the traffic must be filtered are the same for all the VPCs. A network engineer plans to use AWS Network Firewall. The network engineer needs to implement a solution that minimizes the number of firewall policies and rule groups that are necessary for this web filtering. Which combination of steps will meet these requirements? (Choose three.)

Create a firewall policy or rule group in each account.
Use SCPs to share the firewall policy or rule group.
Create a firewall policy or rule group in the management account Source Reference Answer
Use AWS Resource Access Manager (AWS RAM) to share the firewall policy or rule group. Source Reference Answer
Enable sharing within Organizations. Source Reference Answer

Community Votes

CDE

100%

100% of anonymous learners picked answer CDE. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

This question tests your understanding of AWS Network Firewall resource sharing via AWS RAM and the role of the management account, with a common trap of confusing SCPs with resource-sharing mechanisms.

To minimize firewall policies and rule groups for web filtering across many accounts, create the policy in the management account and share it using AWS RAM, with sharing enabled within AWS Organizations. Community consensus is CDE (86%).

Candidates often select B (Use SCPs) because they think SCPs can distribute resources, but SCPs only restrict permissions and cannot share firewall policies or rule groups.

Community Discussion (6 comments)

AzureDP900 👍 1 Selected: CDE

The correct options are: C, D, and E. Option F (creating OUs) is not relevant for implementing web filtering or sharing firewall policies and rule groups across VPCs.

Spaurito 👍 1

CDE - Firewall policy and rule group sharing integrates with AWS Resource Access Manager (AWS RAM). AWS RAM is a service that enables you to share your AWS resources with any AWS account or through AWS Organizations. With AWS RAM, you share resources that you own by creating a resource share. A resource share specifies the resources to share, and the consumers with whom to share them. Consumers can be individual AWS accounts, organizational units, or an entire organization in AWS Organizations. https://docs.aws.amazon.com/network-firewall/latest/developerguide/sharing.html

cas_tori 👍 1 Selected: CDE

this is CDE

hcong 👍 1 Selected: ADE

This combination provides a comprehensive solution to prevent SQL injection attacks: Create a WAF web ACL with appropriate rules Use ALB that can be integrated with WAF Associate WAF with ALB for practical application protection Options B and F are not necessary because the application is internal and does not need CloudFront distribution. Option D is not applicable because NLB cannot be directly integrated with WAF. By implementing these three steps, the company can significantly improve the defense ability of its applications against SQL injection attacks.

aragon_saa 👍 2 Selected: CDE

Answer is CDE

Cacheirez 👍 2 Selected: CDE

By creating the firewall policy or rule group in the management account (the central account in AWS Organizations), the engineer can manage these policies centrally, which reduces the need to create and manage separate policies in each of the 50 accounts. AWS RAM allows you to share AWS resources, such as firewall policies and rule groups, across multiple AWS accounts within your organization. This helps minimize the number of policies that need to be created and ensures consistent web filtering across all accounts. Enabling sharing within AWS Organizations allows the resources shared via AWS RAM (such as firewall policies and rule groups) to be accessed by all accounts within the organization. This facilitates the centralized management and application of the web filtering rules across all VPCs in the 50 accounts.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Explanation

AWS Network Firewall allows you to create firewall policies and rule groups as regional resources. When you have 50 VPCs across 50 accounts that all need the same web filtering, you do not need to create a separate policy in each account. Instead, you create one policy in the management account of AWS Organizations and then share it with all member accounts using AWS Resource Access Manager (AWS RAM).

Why C, D, and E are correct

C. Create a firewall policy or rule group in the management account – The management account is the central account in AWS Organizations. Creating the policy there provides a single source of truth. This directly satisfies the requirement to minimize the number of policies and rule groups.

D. Use AWS Resource Access Manager (AWS RAM) to share the firewall policy or rule group – AWS RAM is the service designed for sharing resources across AWS accounts. Firewall policies and rule groups are shareable resources. By creating a resource share and specifying member accounts, the policy can be used by Network Firewalls in other accounts.

E. Enable sharing within Organizations – When you enable sharing with AWS Organizations in RAM, you can share resources with the entire organization or with specific organizational units (OUs) without listing each account individually. This simplifies the sharing process and is essential for scalable sharing across 50 accounts.

Together, these steps let you manage one firewall policy/rule group in the management account and share it across all VPCs, avoiding duplicated configuration and reducing operational overhead.

Why A and B are wrong

A. Create a firewall policy or rule group in each account – This directly contradicts the requirement to minimize the number of policies and rule groups. It would create 50 copies of the same policy, increasing management complexity and the risk of configuration drift.

B. Use SCPs to share the firewall policy or rule group – SCPs are service control policies; they are used to manage permissions in AWS Organizations, not to share resources. An SCP cannot make a firewall policy or rule group available to another account. Resource sharing is exclusively handled by AWS RAM.

Community insight

The community overwhelmingly supports CDE. As one commenter (Spaurito) explained, "Firewall policy and rule group sharing integrates with AWS Resource Access Manager (AWS RAM). AWS RAM is a service that enables you to share your AWS resources with any AWS account or through AWS Organizations." This highlights the central role of RAM in this scenario.

In summary, the correct answer is CDE.

Official Reference

Exam Strategy

When you see a question about sharing resources across multiple accounts, immediately think of AWS RAM and whether the resource is shareable. Also remember that SCPs are for permissions, not for sharing resources. Eliminate any answer that duplicates resources when centralization is the requirement.

Related Analysis

Practice All ANS-C01 Questions

Access 137 questions with complete answers and detailed explanations.

View Full ANS-C01 Practice Test →

← Back to ANS-C01 Study Guide