A company's AWS infrastructure is spread across more than 50 accounts and across five AWS Regions. The company needs to manage its security posture with simplified administration and maintenance for…

Configuring *only* the Firewall Manager administrator account to join the organization is incorrect; all accounts where resources are to be managed by Firewall Manager must be part of the organization.

All accounts must join the organization so that AWS Firewall Manager can discover and manage resources (like VPCs and their firewalls) across these accounts. Firewall Manager operates at the organization level.

An account must be designated as the Firewall Manager administrator account. This account has the necessary permissions to configure and deploy Firewall Manager policies across the entire organization.

There is no concept of a "Firewall Manager child account" as a distinct configuration step; accounts are simply members of the organization.

AWS Config must be set up for all accounts and all regions where the company has resources. Firewall Manager relies on AWS Config to evaluate compliance and ensure that security policies are consistently applied across the organization's resources.

Setting up AWS Config *only* for the organization's management account is insufficient. Firewall Manager needs AWS Config to be enabled in all member accounts and regions to monitor resource compliance and deploy policies effectively across the distributed infrastructure.