Egress is part of the cloud security boundary
Inbound rules get attention because that is where attacks appear to come from. Outbound is where the consequence happens.
Data leaving, commands arriving, tools being downloaded. A default-allow egress policy means a compromised workload has the whole internet available. It is one of the highest-value controls to add and one of the most disruptive to retrofit, which is why it is worth deciding early.
More on Cloud resilience
- Multi-region is not the same as multi-providerTwo towns, one mains
- Autoscaling can scale a failure tooIt copied the mistake
- Managed services move responsibility, not all riskThe van takes the machines
- Private networking does not automatically mean trustedNobody asks twice
- Snapshots can copy sensitive data silentlyThe copy keeps nothing
- Serverless still has an attack surfaceThe box went, the openings stayed