I'm researching privacy-compliant high-security deployment options for AWS VPC.
I'm looking for a method of tightening outbound traffic from the private subnets at the NAT instance. For example, how could I limit outbound traffic from behind the NAT to only allow calls to AWS S3? I'm planning on creating a custom NAT AMI using Shorewall driven by Ansible and Packer.
It seems there isn't a solid list of S3 IP addresses, so white listing by IP is out. White listing by protocol isn't enough for this; the endpoints should be limited to AWS' API space, at least. White listing by host name certainly won't work beyond the first IP on the first DNS query.
Options seem to be:
- Try to cobble together a list of IPs.
- Ask AWS for a list.
- Maybe I could use HAProxy or similar to do a reverse proxy to S3, skipping the traditional NAT altogether. Supposing the only outbound traffic needed from inside the private subnets is HTTP(S)-based, maybe this would work and a limit to the S3 host name(s) could be done? Things like package updates and NTP could be done with a staging point (instance) located in the public subnet, I suppose.
Please let me know if you'd like further clarification of my needs.
Do you know how to allow only traffic to S3 (and dependencies) from inside the private subnets of an EC2 VPC?
P.S. Oh yeah.. If it can be highly available, that would be great, too. I'm planning one "NAT" or "NAT-like" instance in each of three zones of a single region. I was planning to use an Autoscaling group to keep those three instances alive, but maybe you have another idea. Originally, I was going to use three ENIs, one per AZ, which float via Corosync & Pacemaker for the NAT. I was hoping to skirt the need to update route tables upon NAT failure in a zone by routing to the ENI.