Question

A financial services company routes all outbound VPC traffic through AWS Network Firewall. The security team must inspect the payload of outbound HTTPS connections to detect data exfiltration hidden inside encrypted sessions, while allowing employees to reach approved SaaS providers. Currently, Network Firewall can only match on the SNI of the TLS handshake and cannot see inside the encrypted traffic. Which approach lets the firewall inspect the decrypted application-layer content at scale without deploying third-party proxy appliances?

Accepted Answer

Configure a TLS inspection configuration on the Network Firewall firewall policy, associating an ACM certificate so the firewall can decrypt, inspect, and re-encrypt outbound traffic.

Answer

Enable VPC Flow Logs with the full packet-capture option so the stateful engine can reconstruct and inspect the plaintext payload.

Answer

Add a Suricata rule that references the TLS session keys exported by the client operating systems to decrypt the traffic in the stateful engine.

Answer

Attach an AWS WAF web ACL to the Network Firewall endpoint to perform Layer 7 inspection of the decrypted HTTPS requests.