Question

Your team has an existing VPC firewall rule (priority 1000) that allows inbound TCP traffic on port 443 from 0.0.0.0/0 to all instances. Due to a security incident, you must immediately block all HTTPS traffic from a specific malicious range, 203.0.113.0/24, while keeping port 443 open to everyone else. What is the most effective way to accomplish this?

Accepted Answer

Create a new deny rule for TCP port 443 from source range 203.0.113.0/24 with a priority of 900.

Answer

Edit the existing allow rule to exclude 203.0.113.0/24 from its source range, since a single rule cannot mix allow and deny.

Answer

Create a new deny rule for TCP port 443 from source range 203.0.113.0/24 with a priority of 1100.

Answer

Delete the existing allow rule and recreate it as an egress deny rule targeting 203.0.113.0/24.