r1.5 Outbound traffic control and automated remediation of network deviations
Optimize network posture by strictly controlling CDE egress and automatically remediating network configurations that drift from the approved secure state.
AWS services
AWS Config 
AWS Systems Manager Automation 
Amazon EventBridge 
AWS Lambda 
AWS Network Firewall Requirement 1
Install and Maintain Network Security Controls
PCI sub-requirements covered
- 1.3 Network access to and from the CDE is restricted
- 1.4 Network connections between trusted and untrusted networks are controlled
- 1.5 Risks to the CDE from computing devices that connect to untrusted networks are mitigated
How to implement on AWS
Define the desired network state as code (IaC) and detect drift with AWS Config. Automate remediation of non-compliant rules (e.g. reopened ports) through Config Rules with auto-remediation (SSM Automation) or EventBridge + Lambda. Route all egress through inspection points and domain allow-lists.
Practical implementation
How this control is implemented in each reference architecture:
Define the VPC, subnets, and security groups as IaC and enable AWS Config drift detection in the account. Attach auto-remediation (SSM Automation) to the network Config rules so a reopened port is reverted automatically, and route egress through the Network Firewall allow-lists.
Single-account, 3-tier →Manage the approved network state centrally as IaC and deploy Config rules with auto-remediation across the PCI OU via a conformance pack. Deviations in any CDE account are corrected automatically and surfaced in the security tooling account; egress everywhere flows through the central inspection path.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine NSC configurations to verify that outbound traffic from the CDE is restricted to only what is necessary (1.3.2.b).
- Examine policies, configuration standards, and settings on computing devices that connect to both untrusted networks and the CDE to verify the specific security controls are implemented (1.5.1.a, 1.5.1.b).
Evidence in AWS
- IaC definition of the approved network state and its version history.
- AWS Config rules with auto-remediation and their execution history (SSM Automation).
- EventBridge events and Lambda executions that remediate network rule deviations.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 1.3 — Unauthorized traffic cannot enter the CDE.
- 1.4 — Unauthorized traffic cannot traverse network boundaries between trusted and untrusted networks.
- 1.5 — Devices that connect to untrusted environments and also connect to the CDE cannot introduce threats to the entity's CDE.
Learning resources
References
- AWS Security Maturity Model: Automate deviation correction in configurations