Restrict outbound traffic to AWS SNS / SMTP

Question

So I have an EC2 instance that has a web server. In the security groups I allowed incoming traffic on 80 and 443 but removed all the outgoing traffic for security reasons. My application uses AWS SNS and SMTP, and of course whenever it tries to connect to these services it fails since the outbound traffic is blocked. How can I restrict the outbound traffic to just these services without using a proxy? I tried to check VPC endpoints but didn't find SNS and SMTP in the list.

Answer 1

You will need to enable the ports that these services need to receive your requests. Most AWS services use a REST interface which requires HTTPS (443).

For SNS you will need to enable port 443 outbound.

For SMTP you will need to look up the ports that you configured. For SES this is usually ports 465 or 587.

Amazon publishes ip-ranges.json which contains a list of IP addresses for AWS. You can create a Lambda function to automatically update your security groups with these addresses.

I would not block all outbound ports. Instead I would control where the instance can connect to using security groups and ip-ranges.json. Then I would test that you can still install updates, etc. If your instance is Windows based, then you have another can of worms adding the Microsoft sites.

IMHO: Unless you really need this level of control and security and are prepared to spend a lot of time managing everything ...

AWS IP Address Ranges

Example project:

How to Automatically Update Your Security Groups

Answer 2

To add to John's answer,

last month AWS released a product called "AWS PrivateLink" which enables people to advertise services within a VPC much like S3 endpoints do today. AWS will be publishing AWS services the same way in the coming months, so this may only be a short-term problem for you.

More information can be found https://aws.amazon.com/about-aws/whats-new/2017/11/introducing-aws-privatelink-for-aws-services/