AWS Network Firewall Controls EKS/ECS Traffic with Container Attribute-Based Rules

AWS Network Firewall has launched container attribute-based rules, enabling traffic control for EKS and ECS workloads based on labels or attribute conditions without manually managing IP lists. This feature automatically collects IPs from lifecycle events via container association, maintains a dynamic IP set, and references them as variables in Suricata rules to combine with TLS, FQDN, and GeoIP filtering. No additional fees are incurred.

Internal Implementation and Integration

EKS and ECS differ in their IP collection paths. EKS subscribes to events via the Pulse Event Service, leaving almost no trace in CloudTrail except for a single lookup at creation time. In contrast, ECS creates an EventBridge Managed Rule and polls the ECS API approximately every 9 minutes using a service-linked role, which is recorded in CloudTrail.

Performance and Security Risks

Test results showed that 24 tests (12 allow and block cases run twice each) matched expected values. Initial interpretation time was 23 seconds for EKS custom labels and 18 seconds for ECS custom instance attributes. Dynamic tracking latency varies depending on the presence of filters; without filters, it is 1 second for immediate reflection, but custom attribute filters take 39 to 45 seconds. Notably, there is a decrease-direction latency where IPs of terminated containers remain in the allow set for tens of seconds, which can pose a security risk in scenarios requiring immediate isolation.

Operational Limitations and Recommendations

In EKS, if SNAT (Source Network Address Translation) is enabled in the VPC CNI, pod IPs are translated to node IPs before reaching the firewall, causing rules to fail to match. Therefore, ensure pod IPs are preserved by setting AWS_VPC_K8S_CNI_EXTERNALSNAT=true or similar. Logs record only the reference group name and do not include detailed metadata for pods or tasks, so a real-time IP-container inventory must be loaded to compensate.