Question

A company runs a three-tier application in a VPC with public and private subnets across two Availability Zones. The security team wants centralized, stateful inspection of all north-south traffic (internet-bound and inbound) with the ability to apply Suricata-compatible intrusion prevention signatures. They also require that the inspection layer be highly available and managed by AWS rather than self-managed EC2 appliances. Which deployment approach meets these requirements?

Accepted Answer

Deploy AWS Network Firewall with firewall endpoints in dedicated inspection subnets in each AZ, and update route tables so traffic between the internet gateway and workload subnets is routed through the firewall endpoints.

Answer

Configure stateful network ACLs on the workload subnets with rules that reference the Suricata rule groups, and attach them to each subnet in both AZs.

Answer

Attach security groups with intrusion-prevention rule sets to the EC2 instances in each tier and enable stateful packet inspection at the ENI level.

Answer

Deploy a fleet of self-managed IDS/IPS EC2 instances behind a Gateway Load Balancer in each AZ and route traffic through them using a GWLB endpoint.