Question

A financial services company routes all outbound traffic from a workload VPC through AWS Network Firewall for inspection. Compliance requires that EC2 instances can only reach a fixed set of external SaaS domains over HTTPS. The instances do NOT use a forward proxy, and the security team wants to avoid decrypting traffic due to certificate-handling overhead. They need the firewall to allow only the approved domains and block all other HTTPS destinations. Which approach meets the requirement with the least operational overhead?

Accepted Answer

Create a stateful rule group with domain-list filtering that matches the TLS SNI (server name) for the approved HTTPS domains and set the default action to drop other traffic.

Answer

Configure a stateless rule group that filters on destination IP address ranges published by each SaaS provider and drops all other outbound packets.

Answer

Enable TLS inspection on the firewall, decrypt all outbound HTTPS, and use HTTP host-header rules to allow only the approved domains.

Answer

Use security group egress rules referencing the SaaS provider DNS names to permit only approved outbound connections.