用于AWS服务的AWS私有子网安全组出口白名单？

Question

I have some EC2 instances in a private subnet that need to access DynamoDB and KMS. Since VPC endpoints do not support either of these at this time, I will need to grant internet access via a NAT gateway.

I want to restrict the security group egress rules to only these 2 services, but the only info I have found to date is @ http://docs.aws.amazon.com/general/latest/gr/aws-ip-ranges.html

Has anyone else been able to restrict the security group egress rules to just include AWS services ?

From what I can see the EC2 service entries are a subset of the AMAZON service entries so I'm guessing if I were to include all the CIDR blocks that do not exist in the EC2 list that would leave me with all the other AWS service IPs ?

I know these are dynamic and would therefore need to subscribe and handle updates.

Thanks in advance

Pat

Answer 1

One option is to use the AWS service DNS names (for example dyanamodb.amazonaws.com) in the security group but SG doesn't allow it. So you have 2 options:

1. Allow all outbound access

2. Use a proxy like squid proxy. Add a route to your private subnet to route the internet traffic to the proxy and the proxy is connected to the internet through NAT. In the proxy you can add rules to allow traffic only to the desired services and an explicit DENY for all other traffic