I work for the platform team of my company and we have a central AWS Network Firewall in a central VPC. We provide AWS accounts for different teams and if they need internet access, we connect the VPCs of the teams with a transit gateway to our central VPC and route traffic through our central VPC and firewall into the internet.
We currently only allow to reach certain domains that we whitelist. The problem is, that if we whitelist a URL, every AWS account can reach this URL. Sometimes an aws account needs to reach just one endpoint and not every endpoint, that is whitelisted.
My question is, is it possible to use some kind of conditional rules that only apply to certain accounts/VPCs?
We use Cloudformation for IaC. Any help and examples are highly appreciated!
Cheers
With a centralized AWS Network Firewall you would need help to achieve this.
Your options are limited to distributed AWS Firewall deployment, which will probably be cost prohibitive, or a third-party solution similar to Aviatrix Distributed Cloud Firewall, which builds security services into the data plane / fabric of the network and makes them available in every part of your network.
Disclaimer: I am a network architect at Aviatrix.