Traffic between several VPCs requires stateful inspection and domain filtering.
Do not deploy a separate inspection instance in every application subnet.
Which service is most appropriate?
Deploy AWS Network Firewall in a dedicated inspection subnet and route the VPC traffic through it.
Detailed explanation
DNS records cannot inspect or filter packets.
DNS records cannot inspect or filter packets.
Network Firewall supports stateful and stateless rules and domain-list inspection for routed VPC traffic.
Network Firewall supports stateful and stateless rules and domain-list inspection for routed VPC traffic.
CloudFront is not a general VPC traffic-inspection service.
CloudFront is not a general VPC traffic-inspection service.
Security groups do not provide domain-based stateful inspection across VPCs.
Security groups do not provide domain-based stateful inspection across VPCs.
Check official documentation
Compare the following points with the official documentation.
AWS Network Firewall stateful rules and domain list inspectionの公式説明を確認する。
What to confirm
Security Group、NACL、Network Firewallの適用範囲を区別できる。
Key points
- AWS Network Firewall
- Stateful rules
- Domain list
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Central inspection
Routes can send traffic through a dedicated inspection subnet instead of duplicating appliances.
Control scope
Security groups and NACLs filter network traffic but do not replace domain-aware firewall inspection.