12.3 Network Protection & Edge Security Auditing

12.3 Network Protection & Edge Security Auditing

CloudOps Blueprint Focus: The AWS Certified CloudOps Engineer – Associate (SOA-C03) exam tests network security auditing and cost optimization. You must master Route 53 Resolver DNS Firewall, AWS WAF, AWS Shield Standard and Advanced, AWS Network Firewall, and proven cost-reduction strategies including Gateway Endpoints.

Multi-Layer Network Defense Architecture

Comprehensive cloud security requires layered defense across the OSI model: from DNS resolution (Layer 7 DNS), through edge and application filtering (Layer 7 HTTP/HTTPS), to VPC boundary packet inspection (Layer 3/4 network/transport, Layer 7 deep packet inspection).

---

Amazon Route 53 Resolver DNS Firewall

Adversaries often bypass IP-based security groups using Domain Generation Algorithms (DGAs) and DNS tunneling for data exfiltration. Route 53 Resolver DNS Firewall provides domain-level filtering for all outbound DNS queries originating within a VPC.

Domain Lists & Rule Actions

DNS Firewall evaluates queries against Domain Lists:

• Allowlists: Enforce zero-trust egress by permitting DNS queries only to pre-approved domains (e.g., *.example.com, *.amazonaws.com), blocking all others.
• Blocklists: Explicitly block queries to known malicious domains.
• AWS Managed Domain Lists: Curated threat intelligence lists maintained by AWS, including Malware Domains and Botnet Command-and-Control (C2) Domains.

Matching queries trigger one of three actions: ALLOW (resolves normally), BLOCK (halts resolution, returning NODATA, NXDOMAIN, or OVERRIDE to a sinkhole IP), or ALERT (permits resolution while generating an audit log entry).

Route 53 Resolver Query Logging

Enabling Route 53 Resolver Query Logging records the querying instance IP, domain name, query type, timestamp, and firewall action. Logs stream natively to Amazon CloudWatch Logs, Amazon S3, or Amazon Kinesis Data Firehose for centralized auditing.

---

AWS WAF & AWS Shield: Application & DDoS Protection

AWS WAF (Web Application Firewall)

AWS WAF inspects HTTP/HTTPS requests on Application Load Balancers, API Gateway, CloudFront, and AppSync using Web ACLs containing:

• AWS Managed Rules (AMR): Maintained by AWS Threat Research, including the Common Rule Set (CRS) (OWASP Top 10), SQL Database Rule Set (SQLi), and Known Bad Inputs Rule Set.
• Custom Rate-Based Rules: Track requests per client IP across a 5-minute sliding window. Exceeding the threshold (e.g., 2,000 requests in 5 minutes) triggers an automatic block, mitigating Layer 7 DDoS and brute-force attacks.
• IP & Geo-Match Sets: Filter traffic based on source CIDR ranges or geographic countries.
• Actions: Rules can ALLOW, BLOCK (returning HTTP 403 or 429), COUNT, CAPTCHA, or CHALLENGE.

AWS Shield: Standard vs. Advanced

Every AWS customer receives AWS Shield Standard automatically at no charge, defending against common Layer 3 and Layer 4 volumetric attacks (SYN floods, UDP reflection).

For mission-critical environments, AWS Shield Advanced ($3,000/month base fee plus data usage) provides:

• 24/7 Shield Response Team (SRT): Direct access to AWS DDoS engineers who write custom mitigation rules during active attacks.
• DDoS Cost Protection: Reimburses scaling cost spikes (EC2 Auto Scaling or CloudFront egress) caused by verified DDoS attacks.
• Automatic Layer 7 Mitigation: Automatically generates and tunes WAF rate-limiting rules based on attack traffic signatures.
• Proactive Engagement: Integrates Route 53 health checks to initiate direct outreach from the SRT when application health degrades during an attack.

---

AWS Network Firewall: Perimeter Deep Packet Inspection

AWS Network Firewall delivers managed, stateful network inspection at VPC boundaries. Deployed in dedicated firewall subnets in each AZ, it intercepts traffic at the Internet Gateway via VPC Ingress Routing, NAT Gateways, or Transit Gateways using a dual-engine architecture:

1. Stateless Rule Engine: Evaluates packets individually using 5-tuple matching (source IP/port, destination IP/port, protocol) in strict numerical priority order, executing Drop, Pass, or Forward to the stateful engine.
2. Stateful Rule Engine: Tracks connection state, supporting 5-tuple rules, Domain Name Filtering (inspecting TLS Server Name Indication [SNI] and HTTP Host headers to enforce domain allowlists), and open-source Suricata-compatible IPS rules for deep packet payload inspection.

---

Network Architecture Cost Optimization

Network data transfer is a major operational expense. CloudOps engineers must audit and eliminate architectural cost drivers:

Eliminating NAT Gateway Data Processing Fees

Routing heavy Amazon S3 backup or data lake traffic through a NAT Gateway incurs a $0.045/GB data processing charge ($4,500 per 100 TB). Deploying a Gateway VPC Endpoint for Amazon S3 (which is 100% free) directs S3 traffic directly over the AWS private network, completely bypassing the NAT Gateway and dropping data processing fees to $0.00.