Back to Checks
aws

All AWS FMS policies in the admin account are compliant for all accounts

fms_policy_compliant
Service: fmsSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedtrust-boundaries
Resource Type:Other

Firewall Manager policies in the administrator account are evaluated for organization-wide compliance. The assessment reviews each policy's account-level status and flags entries marked NON_COMPLIANT or unset. It also identifies when no effective policies exist within the administrator scope.

Prowler logoProwlerprowler-provider-aws

Risk

Policy drift or absence leaves in-scope resources without enforced controls, degrading confidentiality, integrity, and availability. Missing WAF, Shield, security group, or network firewall baselines can enable DDoS exposure, unsafe routes, and open access, leading to unauthorized entry and data exfiltration.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks fms_policy_compliant

Recommendation

Maintain centralized enforcement with Firewall Manager: define mandatory policies for all relevant accounts/resources, enable automatic remediation where appropriate, and continuously monitor compliance. Apply least privilege and defense in depth by standardizing web, network, and DNS protections and alerting on drift.

Remediation

Other

1Sign in to the AWS console with the Firewall Manager administrator account
2Open Firewall Manager > Security policies
3If no policies exist: Click Create policy, choose the policy type you use, set scope to All accounts, enable Automatic remediation, and create the policy
4If policies exist with Noncompliant accounts: Open the policy > Edit > enable Automatic remediation and ensure scope includes All accounts > Save
5In AWS Config (organization management account): Settings > Organization settings > Enable recording for all accounts and all regions > Save
6Return to each Firewall Manager policy and verify Accounts within policy scope show Compliant

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.fms.fms_client import fms_client


class fms_policy_compliant(Check):
    def execute(self):
        findings = []
        if fms_client.fms_admin_account:
            report = Check_Report_AWS(metadata=self.metadata(), resource={})
            report.region = fms_client.region
            report.resource_arn = fms_client.policy_arn_template
            report.resource_id = fms_client.audited_account
            report.status = "PASS"
            report.status_extended = "FMS enabled with all compliant accounts."
            non_compliant_policy = False
            if fms_client.fms_policies:
                for policy in fms_client.fms_policies:
                    for policy_to_account in policy.compliance_status:
                        if (
                            policy_to_account.status == "NON_COMPLIANT"
                            or not policy_to_account.status
                        ):
                            report = Check_Report_AWS(
                                metadata=self.metadata(), resource=policy
                            )
                            report.status = "FAIL"
                            report.status_extended = f"FMS with non-compliant policy {policy.name} for account {policy_to_account.account_id}."
                            report.region = fms_client.region
                            non_compliant_policy = True
                            break
                    if non_compliant_policy:
                        break
            else:
                report.status = "FAIL"
                report.status_extended = f"FMS without any compliant policy for account {fms_client.audited_account}."

            findings.append(report)
        return findings

References