Network Firewall Container Attribute-Based Rules

IP collection on the control plane, Suricata @reference expansion on the data path

Network Firewall Container Attribute-Based Rules IP collection on the control plane, Suricata @reference expansion on the data path Control plane (no data-path involvement) Data path EKS Track · pod labels, no prefix · Architecture component EKS Track pod labels, no prefix ECS Track · custom instance attributes · Architecture component ECS Track custom instance attributes Container Association · no filter 1s / attr filter <=45s · Control plane (no data-path involvement) Container Association no filter 1s / attr filter <=45s NFW Control Plane · lifecycle events, attr evaluation · Control plane (no data-path involvement) NFW Control Plane lifecycle events, attr evaluation ECS API · ListTasks / DescribeTasks via SLR · Control plane (no data-path involvement) ECS API ListTasks / DescribeTasks via SLR Dynamic IP Set · decrease slower than increase · Control plane (no data-path involvement) Dynamic IP Set decrease slower than increase DMZVPC-nfw · Suricata rules, data path · Data path DMZVPC-nfw Suricata rules, data path Workload Traffic · SNAT off, awsvpc, routed via firewall · Architecture component Workload Traffic SNAT off, awsvpc, routed via firewall pod label filter instance attr filter association config IP collection (ECS) update IP list @reference expansion inspected traffic Legend Backend Database Cloud External

Architecture diagram • Built with Archify • Create yours ↗ • Hover to trace • R route • Click to focus • +/− zoom • M radar • T theme • E export