Question

A financial services company runs application servers in private subnets across three Availability Zones in a single VPC. Compliance requires that all outbound HTTPS traffic to the internet be restricted so that only a specific approved list of external SaaS domains (e.g., api.partner-a.com, api.partner-b.com) can be reached, and all other outbound connections must be dropped and logged. The team already uses a centralized egress design with a NAT gateway. Which solution meets the requirement with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall with a stateful rule group using domain list rules to allow the approved server-name-indication (SNI) values, set the default action to drop other traffic, enable alert logging, and route outbound traffic through the firewall endpoints before the NAT gateway.

Answer

Configure security groups on the application servers referencing the resolved IP addresses of the approved domains and attach a deny-all outbound rule for everything else.

Answer

Create network ACLs on the private subnets that allow outbound TCP 443 only to the CIDR ranges published by the SaaS providers and deny all other egress.

Answer

Attach AWS WAF with a custom rule group to the NAT gateway that inspects the Host header of outbound HTTPS requests and blocks any domain not on the allow list.