AWS NETWORK FIREWALL EGRESS FILTERING CAN BE EASILY BYPASSED

Summary from the TLDR InfoSec newsletter

AWS Network Firewall is a fully managed service that works as an IDS/IPS to control egress between workloads running in a VPC and the Internet. AWS recommends the use of a domain list to allow specific domains that can be contacted. This post demonstrates that this security measure can be trivially bypassed by spoofing the host name to avoid the block as it doesn't utilize DNS lookups or IP blocking.