A city must inspect and filter VPC egress to the internet with controls deeper than security groups alone. Which service should the architect evaluate for centralized egress filtering?
Select an answer to reveal the explanation.
Short Explanation
Security groups are simple door locks; Network Firewall is the inspected checkpoint on the road out of town. Use it when you need deeper egress filtering than SG rules can express. Cognito, Macie, and ACM do not sit inline on NAT paths deciding which domains leave the VPC.
Full Explanation
AWS Network Firewall provides managed stateful firewall rules, including domain and protocol controls, for traffic leaving or traversing VPC inspection points—commonly paired with centralized inspection architectures and Gateway Load Balancer patterns. Security groups alone lack equivalent deep egress URL/FQDN filtering. Cognito, Macie, and ACM are not packet inspection firewalls for VPC egress, so they do not satisfy the city’s requirement.