How is outgoing network traffic controlled?
amaise controls outgoing network traffic on multiple levels:
NAT gateway: All private subnets use a NAT gateway for outgoing internet traffic.
VPC endpoints: Access to S3 and DynamoDB is via gateway endpoints and does not leave the AWS network.
DNS firewall: Route53 Resolver DNS firewall blocks malicious and suspicious top-level domains as well as known botnet C&C and malware domains in production environments.
Packet inspection: Deep packet inspection is performed on outgoing traffic to detect potentially harmful or unauthorized data transfers.
Allowed services: An allowlist defines the permitted external services (authentication service, cloud APIs, error tracking, monitoring).
Logging: DNS firewall logs are retained for 365 days in CloudWatch.
Incoming traffic is accepted exclusively via HTTPS (port 443) by the load balancer. The WAF filters all incoming traffic.