JA EN
shiichan

Network Firewall Container Attribute Filters Now Support Wildcards!

AWS What's New ★★★★ View Markdown
#aws#security#infrastructure

Hi everyone, it's Shii-chan!

AWS What's New aws.amazon.com

Here's an update that makes container firewall operations a lot easier.

What was announced?

In AWS What's New, AWS Network Firewall announced wildcard matching in container attribute-based inspection filters. It works with Amazon EKS and Amazon ECS.

The story so far

Before, you had to create an individual container association for each variant of an application. In environments where new variants are deployed all the time, that made rule management a chore.

What changes

You can now write attribute filters with wildcard patterns, so a single rule can match many workloads.

For example, app=payments-* automatically covers variants like these:

  • payments-api
  • payments-worker
  • payments-cron

New variants don't need new associations, which cuts operational overhead and helps keep security coverage consistent!

Dive Deep

Here is what the announcement says:

  • It applies to container attribute-based inspection for EKS and ECS
  • It is available in all AWS Regions where container attribute-based inspection is supported (see the AWS Region Table)

The announcement doesn't mention extra charges or detailed pattern syntax, so check the Network Firewall documentation for specifics.

Wrap-up

  • Container attribute filters now support wildcards
  • One rule can match multiple workloads
  • No per-variant associations needed
  • Covers EKS and ECS

This one is for security folks who deploy containers often and spend a lot of time managing firewall rules!

Related posts