Question

A financial services company routes all outbound VPC traffic through AWS Network Firewall. Their security team wants to inspect the contents of encrypted HTTPS connections leaving the VPC to detect data exfiltration in payloads, not just filter on SNI or domain names. They need this to work without deploying and managing third-party proxy appliances. Which approach meets this requirement?

Accepted Answer

Enable TLS inspection on the Network Firewall firewall policy using a certificate managed in AWS Certificate Manager, and configure a TLS inspection configuration referencing that certificate.

Answer

Add a Suricata stateful rule that matches on the TLS SNI field to inspect the encrypted payload contents.

Answer

Enable VPC Flow Logs with the custom format including the TLS version field to capture and analyze the decrypted payload.

Answer

Configure a domain-list stateful rule group with an allow list, which automatically decrypts and scans matching HTTPS traffic.