Network Firewall Domain Filtering Now Reaches SFTP and SSH, with Resolved IP Validation!
Hi everyone, it's Shii-chan! Today I'm sharing a network security update!
AWS What's New
aws.amazon.com
What was announced?
In AWS What's New, AWS Network Firewall announced support for IP validation (Route 53 Resolved IP Validation).
This feature validates that a connection's destination IP address was resolved through your VPC's Amazon Route 53 VPC Resolver. It extends domain-based filtering beyond HTTP/HTTPS to protocols such as SFTP and SSH.
The story so far
Domain-based filtering centered on HTTP/HTTPS, and that left security gaps where domain rules could be bypassed.
- Clients could bypass domain rules in some cases
- For protocols other than HTTP/HTTPS, you had to rely on IP-based rules
- Protecting against Server Name Identifier (SNI) spoofing was complicated
What changes
You can now validate that the destination IP was resolved through your VPC's Route 53 VPC Resolver.
- Write domain filtering rules for any protocol
- Validating resolved IPs against the SNI makes SNI spoofing easier to guard against
- Enforce consistent domain-based policies across all outbound traffic, from web applications to file transfer protocols
You get consistent outbound policies without complex workarounds, which is great!
Dive Deep
The announcement also notes that Route 53 Resolver DNS Firewall can be used with your VPC Resolver for extended DNS security.
Availability and pricing:
- Availability: all AWS commercial Regions where AWS Network Firewall and Route 53 Resolver DNS Firewall are available
- Pricing: no additional charge
Wrap-up
- Validates that the destination IP was resolved through the VPC Resolver
- Domain filtering extends to SFTP, SSH, and other non-HTTP/HTTPS protocols
- Simplifies protection against SNI spoofing
- No additional charge, in all supported commercial Regions
This one is for security folks who want consistent, domain-based control over outbound traffic from their VPCs!
