Using NACL to Block traffic

Question

I have a application on EC2 Instance which connects to a website (github.com) to download application repository (say thrice a week or bit more frequently).

I like to block the access to my VPC using NACL; So no traffic other than from this website github.com (keeping in view that NACL are stateless) can go through.

The issue i am facing is that i cannot whitelist a website using NACL; since the IP based approach is not workable (the IP's are always changing). Can someone suggest a better solution or a fix that we can apply here.

Answer 1

NACL cannot resolve DNS as this requires further OSI layer that has information about the HTTP protocol details.

One option you can do here is to place your EC2 instance behind a NAT gateway , thus effectively placing it in a private subnet and it would translate to an IP that will not change when facing the public internet such as an Elastic IP. In this way, you will be able to protect your EC2 instances while referencing a consistent IP address.

Another option is to use ssh-keygen to generate a public and private key pair which you will then copy over to the respective git repo (SSH key), then block any other protocols and traffic after establishing that one-to-one trust. A more secured version of this is tackled nicely in this post: EC2 can't SSH into github