Exam AWS DevOps Engineer Professional topic 1 question 203 discussion

It's B. Good old RAM to the rescue.

ChatGPT: Option D is the correct solution. This solution involves using AWS Firewall Manager to centrally manage the AWS WAF policy and web ACL for all ALBs in the organization. In the Firewall Manager administrator account, a web ACL is created and defined in an AWS WAF policy. The policy is then deployed to all AWS accounts in the organization. Next, the ALB_WAF_ENABLED AWS Config managed rule is set up in each AWS account with automatic remediation. This rule will attach the web ACL defined in the AWS WAF policy to all ALBs in the account. This approach allows each AWS account to have its own AWS WAF rules in addition to the common set of rules provided by the company’s security team. The central management of the AWS WAF policy and web ACL ensures consistency across all ALBs in the organization, including any ALBs that are created in the future.

revising to A, since WAF is not shareable per saeidp link below.

I like A based on the link saeidp posted

A for me AWS config is only used for detecting the new resources https://aws.amazon.com/blogs/security/using-aws-firewall-manager-and-waf-to-protect-your-web-applications-with-master-rules-and-application-specific-rules/

Option A is incorrect because AWS Firewall Manager is not necessary to achieve the goal. Option B is the better solution because it uses AWS RAM to share the web ACL across all accounts. Option C is incorrect because it applies only to AWS Config and does not provide a solution for deploying the web ACL. Option D is incorrect because it also involves AWS Firewall Manager, which is not necessary to achieve the goal.