Question

A security engineer needs to permanently block a single known-malicious external IP address from reaching any resource across all subnets in a production VPC. The VPC contains dozens of subnets and hundreds of EC2 instances managed by multiple teams, and each team independently controls its own security groups. The engineer wants a solution that enforces the block centrally at the subnet boundary, cannot be overridden by individual application teams modifying security groups, and requires the least ongoing administrative effort. Which approach best meets these requirements?

Accepted Answer

Add a DENY inbound rule for the malicious IP with a lower rule number than the allow rules to the network ACLs associated with each subnet in the VPC.

Answer

Add an inbound DENY rule for the malicious IP to every security group attached to the EC2 instances in the VPC.

Answer

Create an AWS WAF IP set containing the malicious IP and associate it with all instances in the VPC.

Answer

Configure VPC route tables to send traffic destined for the malicious IP to a blackhole route.