Question

A financial services company runs a multi-tier application in a single VPC. The security team requires that all outbound traffic from application subnets be inspected against a continuously updated list of known malicious IP addresses and that stateful connection tracking be applied so that return traffic is automatically allowed without opening broad ephemeral port ranges. They also need centralized, human-readable logging of allowed and denied flows for compliance audits. Which approach best meets these requirements with the least operational overhead?

Accepted Answer

Deploy AWS Network Firewall with a stateful rule group referencing a managed threat-intelligence domain/IP feed, route subnet egress through firewall endpoints, and enable alert and flow logging.

Answer

Attach a network ACL to the application subnets with deny rules for the malicious IP list and rely on the NACL's connection tracking for return traffic.

Answer

Configure security groups on the application instances with outbound deny rules for each malicious IP and enable VPC Flow Logs for auditing.

Answer

Deploy a fleet of self-managed proxy EC2 instances behind a Gateway Load Balancer and maintain the malicious IP list manually in iptables.