Question

A financial services company runs a fleet of EC2 instances in private subnets that must reach the internet through a NAT gateway to download OS patches. Compliance rules require that outbound traffic be restricted so instances can only communicate with a specific allowlist of external domains (such as the OS vendor's update repositories) and all other outbound traffic must be blocked and logged for auditing. Which solution best meets these requirements?

Accepted Answer

Deploy AWS Network Firewall in the VPC with a stateful rule group that uses domain-name filtering to allow only the approved domains, and enable flow logging to capture denied traffic.

Answer

Configure security group outbound rules that reference the IP addresses of the approved update repositories and remove the default allow-all egress rule.

Answer

Use network ACLs on the private subnets to deny all outbound traffic except to the IP ranges of the approved domains and enable VPC Flow Logs.

Answer

Attach AWS WAF to the NAT gateway with a rule set that allows requests to the approved domains and blocks all others.