AWS Network Security Manager

#113 · Level 3 · Modern architecture · Security

Concept

AWS Network Security Manager is a service for setting and turning on network security rules (such as AWS WAF and AWS Shield Advanced rules) across many of an organization’s accounts from one place. The rules are arranged in levels: a Rule is the smallest rule, a few Rules together make a Template, and a few Templates together make a Policy. A Scope decides which accounts and resources a Policy applies to. Even after it is turned on, the service keeps watching all the time — if a rule changes somewhere (drift), it catches it, and if you want, it brings it back to the earlier state. To use it across multiple accounts, you need AWS Organizations.

Simple example

A big school has many branches. The head office makes a rule book once and sends it to every branch, and an inspector regularly checks whether any branch is breaking the rules.

Why it’s needed

With many accounts and many apps, setting security rules separately in each one is hard, and mistakes or gaps happen somewhere. When rules come from one place, every place has the same protection.

Where it’s used

Keeping the same basic WAF rules turned on in all accounts.
Giving separate or exception rules to a specific app.
Checking whether internet-facing resources have DDoS protection (Shield Advanced).
Catching and fixing it when someone changes a rule.

Key terms

English	Simple meaning
Rule	One smallest security rule
Template	A group of a few Rules
Policy	A full set of rules, made of a few Templates, ready to turn on
Scope	Which accounts and resources the rule applies to

Azure equivalent

Azure Firewall Manager (closest)

AWS Firewall Manager · AWS WAF · AWS Shield

Learn more

For details and the latest information, see the official documentation:

AWS Network Security Manager — AWS official documentation ↗