Question

A financial services company hosts a public-facing web application behind an internet-facing Application Load Balancer in a public subnet. The security team requires that all inbound HTTPS traffic from the internet be deep-packet inspected by AWS Network Firewall for exploit signatures BEFORE it reaches the ALB, while preserving the original client source IP for the application's audit logs. The VPC uses an Internet Gateway. Which routing configuration correctly forces inbound internet traffic through the Network Firewall endpoint?

Accepted Answer

Add a route on the Internet Gateway route table (edge association) that sends traffic destined for the public subnet CIDR to the Network Firewall endpoint, and route return traffic from the firewall subnet back through the IGW.

Answer

Attach the Network Firewall endpoint as a target of the ALB and configure the listener to forward decrypted traffic to the firewall before the target group.

Answer

Modify the public subnet's NACL to redirect all inbound port 443 traffic to the Network Firewall endpoint ENI, then allow it onward to the ALB.

Answer

Place the Network Firewall endpoint in the same subnet as the ALB and add a security group rule referencing the firewall endpoint as the source for the ALB.