Question

A financial services company runs a centralized inspection VPC using AWS Network Firewall to inspect all egress traffic from workload VPCs attached to a Transit Gateway. Auditors require that the security team be able to prove, on demand, exactly which domains each workload attempted to reach over the past 90 days, including connections that were ultimately blocked, without dropping any legitimate traffic during the initial rollout. The security team wants to introduce a new set of stateful rules but is concerned about accidentally blocking business-critical traffic before the rules are validated. Which approach best satisfies both the audit-evidence and safe-rollout requirements?

Accepted Answer

Configure the new stateful rule group with rule actions set to 'alert' and enable both alert and flow logging to an S3 bucket with a 90-day lifecycle, then switch selected rules to 'drop' after validation.

Answer

Deploy the rules directly with 'drop' actions but enable flow logs only, relying on the flow logs to capture blocked connection metadata for the auditors.

Answer

Use a stateless rule group with a 'forward to stateful' default action and rely on Transit Gateway Flow Logs sent to CloudWatch Logs to record domain-level attempts.

Answer

Enable TLS inspection with a drop action on all rules and send only alert logs to Kinesis Data Firehose so the auditors can query blocked domains in real time.