c3.13 Control outbound traffic
Inspect outbound (egress) traffic so instances only reach expected destinations — OS/app update sources, approved services — and not malicious URLs/IPs or remote-access tunnels. Combine DNS filtering, a network firewall, and PrivateLink.
Implementation guidance
Why control egress
Egress control ensures your instances talk only where they should, blocking malware callbacks to command-and-control and data exfiltration tunnels. AWS offers several complementary controls:
DNS filtering
Route 53 Resolver DNS Firewall filters outbound DNS for a VPC. Deny all domains except those you explicitly trust; it is simple to deploy centrally across accounts via AWS Firewall Manager. It blocks name resolution rather than IPs, so on its own a client that connects straight to an IP address gets around it. Pair it with resolved IP validation (below) to close that gap. Most malware callbacks use domains, so DNS filtering still stops many infections at the fetch stage.
Network firewall and private paths
- AWS Network Firewall inspects layer 3–7 traffic in and out of a VPC, and supports VPC-to-VPC (east-west) and on-premises inspection.
- AWS PrivateLink keeps traffic to partner or AWS services off the internet entirely.
- You can also deploy an outbound proxy for domain allow-listing and content filtering, or a next-gen firewall from the AWS Marketplace.
Close the bypass with resolved IP validation
Domain allow-lists can be bypassed: a client can connect directly to an IP address, or present an allowed domain in the SNI or Host header while connecting somewhere else. Turn on Route 53 resolved IP validation in your Network Firewall policy so the firewall only allows connections whose destination IP your VPC Resolver actually returned. It also extends domain filtering beyond HTTP/HTTPS to protocols such as SSH and SFTP, at no additional charge.
- Reference a DNS Firewall rule group associated with the VPCs whose traffic you inspect. Every associated VPC contributes to one shared pool of resolved IPs, so keep unrelated VPCs out of it.
- Start in alert mode (it requires firewall logging), review what would be blocked, then switch to drop or reject.
- Route each subnet to the firewall endpoint in its own Availability Zone, because resolutions are recorded per zone. In a centralized inspection VPC, use a Transit Gateway-attached firewall and add the spoke VPC CIDRs as source ranges, since by default only the firewall VPC's own CIDR is validated.
Feed egress logs to your SIEM
Send firewall and proxy logs to your SIEM / Security Lake to detect shadow IT and set additional alerts.
How it fits together
How to validate
- Do you restrict outbound traffic to expected destinations (DNS Firewall, Network Firewall, or a proxy)?
- Does Network Firewall block connections to IPs your VPC Resolver did not return (resolved IP validation), so domain allow-lists cannot be bypassed by connecting straight to an IP?
- Are partner/service connections kept off the internet with PrivateLink where possible?
- Are egress logs sent to your SIEM to detect shadow IT and anomalies?
Threats addressed
- Without egress control, a compromised instance can freely call out to command-and-control servers, download additional malware, or exfiltrate data through an outbound tunnel.
AWS services
Amazon Route 53 Resolver DNS Firewall 
AWS Network Firewall 
AWS PrivateLink Pricing
See Route 53 Resolver DNS Firewall, AWS Network Firewall, and AWS PrivateLink pricing.