Egress Filtering

Egress filtering restricts outbound network traffic from cloud workloads to only authorized destinations, preventing compromised workloads from beaconing to command-and-control servers, exfiltrating data to attacker-controlled endpoints, or facilitating SSRF attacks against external services. Cloud egress controls include VPC security group outbound rules, NACLs, Network Firewall domain-based filtering, and Kubernetes network policies with egress rules.

Egress filtering is a key defense against post-compromise data exfiltration.