Alert actions can log matching traffic observations without requiring immediate blocking for every trial signature; this belongs to nonblocking stateful threat detection, while the problem is enforced packet path through inspection resources.

Network Firewall inspects flows with stateful rule evaluation and can apply supported Suricata or domain-oriented rules at routed inspection endpoints; this changes managed stateful deep inspection of VPC flows, not the necessary enforced packet path through inspection resources.

In the centralized multi-account network security policy rollout workflow, firewall Manager coordinates supported WAF, Shield, network firewall, and security-group policies organization-wide; the current case needs enforced packet path through inspection resources.

Endpoint policy permissions are an additional authorization boundary for traffic using the endpoint, not a substitute for identity permissions; that addresses authorization filtering on private AWS service endpoints, rather than narrowly scoped private vendor-service access.

PrivateLink limits network exposure to a specific service endpoint without requiring full routed adjacency between customer and provider address ranges; this belongs to least-exposure private application connectivity, while the problem is narrowly scoped private vendor-service access.

In the private endpoint interface security-group authorization workflow, interface endpoints use ENIs and security groups; traffic needs network admission at those endpoint interfaces; the current case needs narrowly scoped private vendor-service access.

Transit routing tables create forwarding domains; a shared attachment hub need not imply universal VPC reachability; that addresses routing-based isolation among tenant VPCs, rather than approved application security-group sources plus NACL denial.

Egress-only internet gateways allow IPv6 outbound connections and their replies without offering public initiation into the VPC; this belongs to stateful-looking outbound-only IPv6 gateway control, while the problem is approved application security-group sources plus NACL denial.

In the geography-based web request enforcement workflow, WAF inspects inferred geographic source attributes on HTTP requests and can block requests that match the location policy; the current case needs approved application security-group sources plus NACL denial.

Stateful security groups can match source security-group identity rather than broadly allowing an entire VPC or unpredictable load-balancer addresses; that addresses stateful source-restricted access from load balancer to target, rather than resource-specific database ingress separation.

NACLs offer ordered deny rules at the subnet boundary, unlike security groups, which support allow rules but not explicit denies; this belongs to blocking a specific source using an explicit network deny, while the problem is resource-specific database ingress separation.

In the centrally governed exposure of sensitive database ports workflow, central policy scans and enforces supported security-group posture at scale rather than relying on individual account owners to self-audit; the current case needs resource-specific database ingress separation.

NACLs evaluate from the lowest rule number first, so a number of 110 makes the exception even later than the blocking DENY 90.

NACLs are stateless. They do not gain connection tracking by changing a setting; explicit numbered rules determine each direction.

A security-group allow rule cannot override a subnet ACL DENY that matches the packet first. The subnet NACL is stateless and its first matching numbered rule decides admission.

Service control policies limit identities' effective AWS permissions; they do not replace security groups, NACLs, or firewall routing; that addresses separation of organizational API governance and packet admission, rather than preventive guardrails for risky public networking deployments.

Central policy scans and enforces supported security-group posture at scale rather than relying on individual account owners to self-audit; this belongs to centrally governed exposure of sensitive database ports, while the problem is preventive guardrails for risky public networking deployments.

Stateful security groups can match source security-group identity rather than broadly allowing an entire VPC or unpredictable load-balancer addresses; this changes stateful source-restricted access from load balancer to target, not the necessary preventive guardrails for risky public networking deployments.

In the scalable inline third-party firewall appliances workflow, gateway Load Balancer transparently distributes encapsulated flows to virtual appliances, while endpoints provide route-table insertion points; the current case needs preventive guardrails for risky public networking deployments.

This produces narrowly scoped private vendor-service access: Consumer endpoints expose a local private interface to a selected service and do not establish general-purpose reciprocal VPC routes; the stem instead tests preventive guardrails for risky public networking deployments.

Network Firewall inspects flows with stateful rule evaluation and can apply supported Suricata or domain-oriented rules at routed inspection endpoints; this belongs to managed stateful deep inspection of VPC flows, while the problem is centralized multi-account network security policy rollout.

Gateway Load Balancer routes flows to available firewall appliance instances through transparent endpoints, improving scaling and failure handling; this changes highly available virtual firewall insertion, not the necessary centralized multi-account network security policy rollout.

In the least-exposure private application connectivity workflow, privateLink limits network exposure to a specific service endpoint without requiring full routed adjacency between customer and provider address ranges; the current case needs centralized multi-account network security policy rollout.

Flow Logs record observed IP traffic, not which authenticated IAM principal called CreateTransitGatewayRoute or DeleteTransitGatewayRoute on the control plane.

DNS Firewall filters DNS name lookups. Transit Gateway routing updates are AWS EC2 management API events, which are unrelated to the application DNS query policy.

Restricting route-table propagation changes forwarding behavior, not the notification workflow. It does not automatically send incident alerts on an operator’s API changes.

Delivery configuration and IAM authorization must both allow log-stream creation and event publication; that addresses authorized publication of VPC flow telemetry, rather than tamper-resistant multi-account network flow retention.

Network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; this belongs to selecting the right logging layer for HTTP investigation, while the problem is tamper-resistant multi-account network flow retention.

Flow logs record accept/reject decisions and packet metadata at the chosen aggregation scope; this changes rejected flow evidence across VPC environments, not the necessary tamper-resistant multi-account network flow retention.

Centralized log custody and controlled permissions reduce risk that workload operators can erase records of network activity; this belongs to tamper-resistant multi-account network flow retention, while the problem is rejected flow evidence across VPC environments.

Aggregate bytes reveal load but not communicating endpoints; flow records provide connection-oriented metadata; this changes network endpoint attribution for data movement, not the necessary rejected flow evidence across VPC environments.

In the detailed managed firewall policy outcome evidence workflow, firewall event logs provide inspection decisions and flow state that ordinary VPC flow logs cannot fully describe; the current case needs rejected flow evidence across VPC environments.

WAF request logs show rule evaluation and final actions, providing decision evidence beyond CloudFront's general access response; that addresses rule-level web firewall decision evidence, rather than web request forensic evidence beyond network metadata.

Configuration assessment can flag resources that violate the required monitoring policy without sampling their live traffic; this belongs to automated verification of load-balancer logging posture, while the problem is web request forensic evidence beyond network metadata.

In the selecting the right logging layer for HTTP investigation workflow, network flow summaries do not include HTTP payload and URI content, so a different telemetry layer is required; the current case needs web request forensic evidence beyond network metadata.