# Network Firewall + Firewall Manager Checklist (July 2026)

## Architecture pick

- [ ] Prefer **centralized inspection VPC** + TGW at >~10 VPCs
- [ ] Distributed only for few isolated VPCs / no TGW

## Policy

- [ ] Suricata rulesets versioned; start alert-only then prevent
- [ ] Domain egress allow-list (specific FQDNs, not `*.amazonaws.com`)
- [ ] TLS inspection bypass list before enable (pinned certs, AWS endpoints)
- [ ] Firewall Manager policy for Org OUs; SCP-lock local disable where required

## Ops

- [ ] Alert + flow logs → SIEM / Security Lake
- [ ] Compose with WAF (HTTP edge) + Verified Access (workforce)

## Counter-case

Security groups ≠ L7 egress/IDS. FMS without log review is policy theater.