Question

A financial services company routes all outbound internet traffic from its VPCs through a centralized inspection VPC that uses AWS Network Firewall. Compliance requires that the firewall block access to any HTTPS destination outside an approved list of fully qualified domain names (FQDNs). Currently the firewall's stateful rules match on the TLS Server Name Indication (SNI), but security auditors report that some clients bypass the controls by sending a benign SNI while connecting to a disallowed domain. Which change most directly closes this gap while keeping the approved-domain allow-list model?

Accepted Answer

Enable TLS inspection configuration on the Network Firewall so it decrypts the session and enforces rules against the actual certificate and HTTP Host header rather than the SNI alone

Answer

Replace the stateful domain rules with stateless rules that filter on destination IP address ranges resolved from the approved FQDNs

Answer

Add a Route 53 Resolver DNS Firewall rule group that blocks all domains not on the approved list and attach it to the inspection VPC

Answer

Configure the firewall to drop any packet where the TLS SNI extension is absent and rely on strict SNI matching for the rest