Can AWS Network Firewall allow traffic from an instance using its tags or some other metadata

Question

Can AWS Network Firewall allow traffic from an instance using its tags or some other metadata?
Use case: We have an instance in the same subnets as the other instances. We want that instance to access a smaller list of allowed targets (outbound internet domains or only allow that instance to access a target and not the other instances within the same subnets

Accepted Answer

AWS Firewall does not currently support using tags or other metadata. These are your available rule groups that you can create https://docs.aws.amazon.com/network-firewall/latest/developerguide/rule-groups.html.

In addition AWS firewall can't inspect instances within the same subnet https://aws.amazon.com/blogs/aws/inspect-subnet-to-subnet-traffic-with-amazon-vpc-more-specific-routing/

Here are some good deployment models for AWS Firewall https://aws.amazon.com/blogs/networking-and-content-delivery/deployment-models-for-aws-network-firewall-with-vpc-routing-enhancements/

Can AWS Network Firewall allow traffic from an instance using its tags or some other metadata

Relevanter Inhalt