Implement secure key and certificate management: Store encryption keys and certificates securely and rotate them at appropriate time intervals while applying strict access control for example, by using a certificate management service, such as AWS Certificate Manager (ACM).Įnforce encryption in transit: Enforce your defined encryption requirements based on appropriate standards and recommendations to help you meet your organizational, legal, and compliance requirements.Īutomate detection of unintended data access: Use tools such as GuardDuty to automatically detect attempts to move data outside of defined boundaries based on data classification level, for example, to detect a trojan that is copying data to an unknown or untrusted network using the DNS protocol.Īuthenticate network communications: Verify the identity of communications by using protocols that support authentication, such as Transport Layer Security (TLS) or IPsec. Make sure that you include the IP addresses of the NLB in the configured firewall rules. Some Network Load Balancers (NLB) use HTTP port 80 for probing the health on individual federation servers. The solution itself is straight forward and easy. Ideally we would put our entire setup behind WAF, but WAF is not NLB compatible and we are unable to use an ALB due to the number of certificates we have to maintain. A: How do you protect your data in transit? The rules should only allow inbound communication from the IP addresses of the servers in the farm and WAP servers. AWS WAF is a web application firewall which protects web applications from threats which could compromise their security or consume resources.

Waf nlb