Introducing Route 53 Resolved IP Validation for AWS Network Firewall
AWS now lets Network Firewall validate that non-HTTP connections actually resolve to the domain on the allow-list via Route 53 integration, closing a long-standing DNS-based evasion vector for SSH, RDP, and similar protocols.
Summary written by editorial AI · Source link below
Your workloads reach most destinations by domain name, but a firewall can only act on what it sees in the traffic. For HTTP and HTTPS, AWS Network Firewall domain rules match the name that the client puts in the request, and the client chooses that name. The connections for protocols such as SSH and SSH […]
Editorial Analysis
Domain-based firewall rules for non-HTTP protocols have long been bypassable; this feature materially strengthens egress controls for AWS-heavy European enterprises.
Activate Route 53 Resolved IP Validation on your AWS Network Firewall policies and audit existing domain-based egress rules for non-HTTP protocols.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at AWS Security Blog in a new tab.
More from the Cloud Desk
- Addressing protocol security gaps in multi-tenant Kubernetes3d
- Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps3d
- LLMjacking Emerges as Thriving Cybercriminal Enterprise6d
- Google adds new $250,000 Cloud VRP reward for Root-in-Cloud bugs6d
- Inside a successful AWS European Sovereign Cloud exercise to demonstrate independent operation2 Nov