How to enforce a third-party WAF managed rule group across all accounts and Regions?
A company purchased a third-party managed rule group from AWS Marketplace to use with AWS WAF. The company uses AWS Organizations to manage multiple AWS accounts in a single organization. Application Load Balancers (ALBs) are present in multiple accounts and multiple AWS Regions. The company needs a solution to ensure that the rule group is used with every web ACL that is attached to every ALB. Which solution will meet this requirement with the LEAST operational overhead?
Community Insight
Tests centralized enforcement of an AWS WAF managed rule group across an AWS Organization; the trap is treating an SCP as a mechanism that can inject WAF rule group ARNs into existing web ACLs.
AWS WAF third-party managed rule groups can be enforced organization-wide through an AWS Firewall Manager WAF policy scoped to all accounts and Regions. This page explains why option C satisfies the least-operational-overhead requirement and why SCPs, stack sets, and Security Hub CSPM findings do not.
Choosing CloudFormation stack sets (A) because they appear automated, but they require maintaining templates and handling every existing web ACL per account and Region, which is more operational overhead than a Firewall Manager policy.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Firewall Manager is designed for organization-wide security policy enforcement, including AWS WAF policies that attach a managed rule group to web ACLs across accounts and Regions. A Firewall Manager WAF policy with scope set to all accounts and Regions automatically applies the third-party managed rule group to in-scope web ACLs, including existing and newly created resources. This directly meets the requirement of ensuring the rule group is used with every web ACL attached to every ALB while minimizing ongoing administration. Because Firewall Manager integrates with AWS Organizations, the company does not need to build or maintain per-account deployment automation.Why the Other Options Are Wrong
Option A uses CloudFormation stack sets, which can deploy templates across accounts and Regions, but it still requires authoring and maintaining the template, handling existing web ACLs, and managing stack instances. Option B is invalid because an SCP constrains IAM permissions and cannot insert a WAF rule group ARN into a web ACL. Option D uses Security Hub CSPM only to detect and generate a finding when the rule group is missing, so it provides visibility but not enforcement.Community Comment Notes
seoyeon_01 asked for an explanation of why the correct answer works, which is exactly the gap this analysis addresses: Firewall Manager is the native centralized enforcement point for WAF policies in an organization. No commenter provided a competing technical argument for stack sets, SCPs, or Security Hub CSPM as enforcement mechanisms. The key distinction is between detecting a missing rule group and actually applying it to every web ACL.Official Reference
Exam Strategy
When a requirement spans multiple accounts and Regions and asks for the least operational overhead, look for an AWS Organizations-integrated central management service such as Firewall Manager. Rule out options that only detect drift or that require per-account templates and manual handling of existing resources.
Frequently Asked Questions
Why can't an SCP add a WAF managed rule group to existing web ACLs?
SCPs only constrain IAM permissions; they cannot modify or populate AWS WAF web ACL rule groups, so option B cannot enforce the third-party managed rule group.
Does Security Hub CSPM remediate a missing WAF rule group?
No. Security Hub CSPM can generate findings for missing controls but does not automatically insert the third-party managed rule group into every web ACL.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →