Question

A financial services company runs a centralized inspection VPC with AWS Network Firewall for all outbound internet traffic from workloads across multiple accounts via a Transit Gateway. The security team must ensure that all data leaving the environment toward on-premises data centers over the Site-to-Site VPN is encrypted in transit, and that any workload attempting to establish an unencrypted (plaintext) connection to an external partner API endpoint is blocked. Traffic to the partner endpoint uses HTTPS on port 443, but the team suspects some legacy applications fall back to HTTP on port 80. Which approach BEST enforces encryption-in-transit requirements for the outbound partner traffic while minimizing operational overhead?

Accepted Answer

Configure a Network Firewall stateful rule group that drops any TCP traffic destined to the partner endpoint on port 80, and rely on the Site-to-Site VPN's IPsec encryption for the on-premises path.

Answer

Enable TLS inspection on the VPN tunnel and configure a stateless rule to reject all traffic on port 80 across the inspection VPC.

Answer

Attach a security group to the Transit Gateway attachment that denies outbound port 80 and require IPsec transport mode on all partner connections.

Answer

Deploy AWS WAF on the Network Firewall endpoint to block HTTP requests and enable MACsec on the Site-to-Site VPN for encryption in transit.