r1.4 Traffic inspection with AWS Network Firewall at the CDE perimeter
Deploy stateful network security controls with deep packet inspection at the CDE boundaries to filter traffic by application and domain rules, beyond what security groups and NACLs offer.
AWS services
AWS Network Firewall 
AWS Transit Gateway 
Amazon CloudWatch Logs Requirement 1
Install and Maintain Network Security Controls
PCI sub-requirements covered
- 1.3 Network access to and from the CDE is restricted
- 1.4 Network connections between trusted and untrusted networks are controlled
How to implement on AWS
Implement AWS Network Firewall in dedicated inspection subnets, with Suricata rules for domain (FQDN) filtering and threat signatures. Centralize inspection in an inspection VPC connected via Transit Gateway. Log allowed and blocked traffic to CloudWatch Logs or S3 for evidence.
Practical implementation
How this control is implemented in each reference architecture:
Deploy AWS Network Firewall in dedicated inspection subnets within the same VPC and route the CDE subnets' egress through it, with FQDN allow-lists for the destinations the CDE legitimately needs. Send firewall flow logs to CloudWatch Logs or S3 for evidence.
Single-account, 3-tier →Run AWS Network Firewall centrally in the network account's inspection VPC. Transit Gateway routing sends all CDE east-west and egress traffic through it, so a single, consistently managed policy protects every CDE account. Firewall logs are delivered to the central log-archive account.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine vendor documentation and NSC configurations to verify that inbound traffic from untrusted networks to trusted networks is restricted (1.4.2).
- Examine NSC configurations to verify that outbound traffic from the CDE is restricted to only what is necessary (1.3.2.b).
- Examine NSC configurations to verify that anti-spoofing measures detect and block forged source IP addresses (1.4.3).
Evidence in AWS
- AWS Network Firewall rule groups (policy) showing domain filtering and signatures.
- Firewall flow logs in CloudWatch/S3 evidencing allowed and denied traffic.
- Inspection-VPC architecture with routes that force traffic through the firewall.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 1.3 — Unauthorized traffic cannot enter the CDE.
- 1.4 — Unauthorized traffic cannot traverse network boundaries between trusted and untrusted networks.
Learning resources
References
- AWS Security Maturity Model: Outbound Traffic Control