Question

A financial services company runs a fleet of EC2 instances in private subnets that must reach only a small, approved set of external SaaS endpoints (identified by domain name) over HTTPS. Traffic to any other external destination must be blocked and logged. The instances have no public IPs and route outbound traffic through a NAT gateway. Security groups and NACLs currently allow all outbound traffic on port 443. Which solution best enforces domain-based egress filtering with centralized inspection and logging?

Accepted Answer

Deploy AWS Network Firewall with a Suricata-compatible stateful rule group that allows only the approved TLS SNI domains and drops all other traffic, then route the private subnets' outbound traffic through the firewall endpoints.

Answer

Replace the security group rules with domain-name-based outbound rules that reference the approved SaaS FQDNs and deny all other destinations.

Answer

Attach AWS WAF to the NAT gateway with a rule that inspects the Host header and blocks requests to unapproved domains.

Answer

Create NACL entries on the private subnets that permit outbound traffic only to the resolved IP addresses of the approved SaaS domains and deny the rest.