All AWS FMS policies are compliant for all accounts

​

What this check verifies

Firewall Manager policies in the administrator account are evaluated for organization-wide compliance. The assessment reviews each policy’s account-level status and flags entries marked NON_COMPLIANT or unset. It also identifies when no effective policies exist within the administrator scope.

​

Risk

Policy drift or absence leaves in-scope resources without enforced controls, degrading confidentiality, integrity, and availability. Missing WAF, Shield, security group, or network firewall baselines can enable DDoS exposure, unsafe routes, and open access, leading to unauthorized entry and data exfiltration.

​

Recommendation

Maintain centralized enforcement with Firewall Manager: define mandatory policies for all relevant accounts/resources, enable automatic remediation where appropriate, and continuously monitor compliance. Apply least privilege and defense in depth by standardizing web, network, and DNS protections and alerting on drift.

​

Remediation

Dashboard steps

1. Sign in to the AWS console with the Firewall Manager administrator account
2. Open Firewall Manager > Security policies
3. If no policies exist: Click Create policy, choose the policy type you use, set scope to All accounts, enable Automatic remediation, and create the policy
4. If policies exist with Noncompliant accounts: Open the policy > Edit > enable Automatic remediation and ensure scope includes All accounts > Save
5. In AWS Config (organization management account): Settings > Organization settings > Enable recording for all accounts and all regions > Save
6. Return to each Firewall Manager policy and verify Accounts within policy scope show Compliant

​

References

• https://aws.amazon.com/firewall-manager/faqs/
• https://docs.aws.amazon.com/waf/latest/developerguide/getting-started-fms-intro.html
• https://www.amazonaws.cn/en/firewall-manager/faqs/
• https://docs.aws.amazon.com/waf/latest/developerguide/fms-compliance.html

​

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = fms_policy_compliant. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to AWS checks