Robust network configuration

The following diagram shows how an ideal network should be built to protect the network by filtering malicious traffic that comes into an organization and blocking traffic that is not supposed to reach the internet or specific sites on the internet. The network can also control traffic within the organization based on your organization's security requirements.

All inbound traffic that comes to services hosted by the organization is filtered by AWS WAF and AWS Network Firewall before the traffic reaches the Amazon Elastic Compute Cloud (Amazon EC2) instances. All outbound traffic from the organization is filtered by Network Firewall first before it reaches the destination. Amazon Route 53 manages all the DNS resolutions and provides a source to query DNS logs. AWS Transit Gateway elastic network interfaces help provide centralized networking.