Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon Firewall Manager policy scope

The policy scope defines where the policy applies. You can either apply centrally controlled policies to all of your accounts and resources within your organization in Amazon Organizations, or to a subset of your accounts and resources. For instructions on how to set policy scope, see Creating an Amazon Firewall Manager policy.

Policy scope options in Amazon Firewall Manager

When you add a new account or resource to your organization, Firewall Manager automatically assesses it against your settings for each policy and applies the policy based on these settings. For example, you can choose to apply a policy to all accounts except the account numbers in a specified list; you can also choose to apply a policy only to resources that have all of the tags in a list.

Amazon Web Services accounts in scope

The settings that you provide to define the Amazon Web Services accounts affected by the policy determine which of the accounts in your Amazon organization to apply the policy to. You can choose to apply the policy in one of the following ways:

For information about Amazon Organizations, see Amazon Organizations User Guide.

Resources in scope

Similarly to the settings for accounts in scope, the settings that you provide for resources determine which in-scope resource types to apply the policy to. You can choose one of the following:

You can only specify resource tags with non-null values. If you don't provide anything for the value, Firewall Manager saves the tag with an empty string value: "". Resource tags only match with tags that have the same key and the same value.

For more information about tagging your resources, see Working with Tag Editor.

Policy scope management in Amazon Firewall Manager

When policies are in place, Firewall Manager manages them continuously and applies them to new Amazon Web Services accounts and resources as they are added, in accordance with the policy scope.

How Firewall Manager manages Amazon Web Services accounts and resources

If an account or resource goes out of scope for any reason, Amazon Firewall Manager doesn't automatically remove protections or delete Firewall Manager-managed resources unless you select the Automatically remove protections from resources that leave the policy scope check box.

Selecting this check box directs Amazon Firewall Manager to automatically clean up resources that Firewall Manager manages for accounts when those accounts leave the policy scope. For example, Firewall Manager will disassociate a Firewall Manager-managed web ACL from a protected customer resource when the customer resource leaves the policy scope.

To determine which resources should be removed from protection when a customer resource leaves the policy scope, Firewall Manager follows these guidelines: