A company plans to host public websites on AWS with multiple tiers (web, application, database). They will use AWS Network Firewall, AWS WAF, and VPC security groups. Firewalls must be deployed into the correct VPCs, policies for Network Firewall and AWS WAF must be centrally manageable, and application teams should be able to manage their own security groups while preventing overly permissive rules. What is the most operationally efficient solution that meets these needs?

The correct answer leverages AWS Firewall Manager for centralized management and deployment across multiple accounts/VPCs, which is key for operational efficiency with Network Firewall, WAF, and security groups. CloudFormation is used for initial resource deployment as code, ensuring consistency. Firewall Manager then takes over the ongoing management of WAF ACLs, Network Firewall policies, and security groups, allowing for consistent application of rules and policies across the organization. GuardDuty monitors for overly permissive rules, addressing the requirement to prevent such configurations. Incorrect options: Using CloudFormation for all updates (option 1) is less operationally efficient for ongoing policy management across multiple accounts/VPCs compared to Firewall Manager. Manually managing policies via Console/CLI (option 2) is not scalable or efficient for a multi-tier, multi-VPC environment. Deploying WAF IP sets/ACLs with CloudFormation and then using Firewall Manager only for Network Firewall/security groups (option 3) misses the opportunity to centrally manage WAF ACLs with Firewall Manager, which is a core capability for efficiency.