A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture…

To implement AWS Firewall Manager for centralized security policy administration across a multi-account, multi-Region environment, specific prerequisites must be met after creating an AWS Organization. First, all accounts intended for management must be members of the organization (B). This allows a central administrator to apply policies across them. Second, one account must be designated as the Firewall Manager administrator; this account will create and manage the security policies for the entire organization (C). Third, AWS Config must be enabled for all member accounts in all Regions where resources exist. Firewall Manager relies on AWS Config to detect resources and monitor their compliance with the deployed security policies (E).

A. Configuring only the administrator account to join the organization is incorrect because Firewall Manager cannot manage accounts that are not part of the organization.

D. The term "Firewall Manager child account" is not a valid AWS concept. Accounts are designated as either the administrator or as member accounts within the organization.

F. Enabling AWS Config only for the organization's management account is insufficient. Firewall Manager requires AWS Config on all member accounts to monitor their resources for policy compliance.

1. AWS Firewall Manager Developer Guide, "Prerequisites for AWS Firewall Manager": This document explicitly lists the requirements.

"An AWS account that's part of an organization in AWS Organizations. You must have all features enabled for your organization." (Supports option B)

"An AWS account that you designate as the AWS Firewall Manager administrator for your organization." (Supports option C)

"AWS Config enabled for all of the accounts in your organization... If you don't enable AWS Config for each member account, Firewall Manager can't detect the resources that are out of compliance with your policies." (Supports option E, refutes F)

Source: https://docs.aws.amazon.com/waf/latest/developerguide/fms-prereqs.html

2. AWS Organizations User Guide, "Enable a trusted service with AWS Organizations": This guide explains the concept of designating a member account as a delegated administrator for a service like Firewall Manager.

"When you designate a delegated administrator for a service, that account has the permissions to manage the AWS service and the member accounts of the organization that use that service." (Supports the concept in option C)

Source: https://docs.aws.amazon.com/organizations/latest/userguide/services-that-can-integrate-orgs.html#integrated-service-enable-trusted-access