Question

A company runs hundreds of EC2 instances across multiple private subnets in a single VPC. Security policy requires that outbound HTTPS traffic to the internet be allowed ONLY to an approved list of fully qualified domain names (for example, updates.vendor.com and api.partner.com), and all other outbound traffic must be denied and logged. The solution must be centrally managed, scale with the fleet, and inspect traffic at the application layer without deploying agents on the instances. Which approach best meets these requirements?

Accepted Answer

Deploy AWS Network Firewall in the VPC with a stateful rule group using domain list (FQDN) filtering for the approved domains, route outbound subnet traffic through the firewall endpoints, and enable alert/flow logging.

Answer

Configure security group outbound rules referencing the approved domain names and attach them to every instance, then use VPC Flow Logs to capture denied traffic.

Answer

Create network ACL egress rules that allow HTTPS only to the resolved IP addresses of the approved domains and deny all other outbound traffic.

Answer

Deploy AWS WAF with a rule set matching the approved host headers and associate it with the internet gateway to filter outbound requests.