AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

Secure Amazon container workloads using container attribute-based rules in AWS Network Firewall

infonews

security

Source: AWS Security BlogJuly 1, 2026

Summary

AWS Network Firewall now supports container attribute-based rules that let you write firewall rules for Kubernetes pods using their attributes (like namespace and pod name) instead of their IP addresses, which constantly change as containers restart or scale. This solves the problem of maintaining static firewall rules in dynamic container environments, and it enriches security logs with container context so security teams can trace blocked traffic back to its source workload.

Solution / Mitigation

The source describes the feature itself as the solution rather than a separate mitigation. It states: 'When you create a container association and link it to your EKS cluster, Network Firewall automatically discovers and tracks the pods that match your defined attributes (namespace, labels, cluster name) and resolves them to their current IP addresses. As pods scale up or restart, the firewall dynamically updates the IP-to-attribute mapping in near real-time and no manual rule updates are required.' The feature is included in the base tier of Network Firewall at no additional charge. Example rules are provided using Suricata rule syntax with container attribute aliases (e.g., @ecommerce_pods) to define Layer 7 application rules and pod group rules.