Wombat

WAF-SOV-090 – Controlled Egress & Data Exfiltration Guardrails

Pillar: Sovereign | Severity: High | Category: Identity Access | Automatable: High

Description

Outbound network traffic MUST be controlled using a default-deny or strict allow-list policy. Security groups must not permit unrestricted egress (0.0.0.0/0) without explicit justification. VPC endpoints MUST be used for access to cloud provider APIs to keep traffic on the sovereign network. Data exfiltration detection MUST be established to alert on anomalous outbound data volumes or unexpected destinations.

Rationale

Risk Description

Risk

Open outbound traffic enables data exfiltration and command-and-control communication.

Risk

Missing default-deny network rules let attackers reach external services unhindered.

Requirements

  • Outbound network traffic MUST be controlled using a default-deny or strict allow-list policy.

  • Security groups must not permit unrestricted egress (0.0.0.0/0) without explicit justification.

  • VPC endpoints MUST be used for access to cloud provider APIs to keep traffic on the sovereign network.

  • Data exfiltration detection MUST be established to alert on anomalous outbound data volumes or unexpected destinations.

Implementation Guidance

  1. Define the requirement in workload documentation.

  2. Implement the control in the relevant tooling or process.

  3. Validate compliance through automated tests or peer review.

Maturity Levels

Level Name Criteria

L1

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

L2

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

L3

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

L4

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

L5

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sov-090.tf.aws.no-unrestricted-egress

Engine: terraform | Provider: aws | Automated: Yes

Security groups must not allow unrestricted egress to 0.0.0.0/0

AWS security group rules with type=egress and cidr_blocks containing 0.0.0.0/0 or ::/0 should not exist without documented justification. Unrestricted egress enables data exfiltration and violates the principle of least-privilege networking.

Scope: resource — aws_security_group_rule, aws_security_group

Assertions: * egress.cidr_blocks not contains 0.0.0.0/0 — Security group allows unrestricted outbound access to 0.0.0.0/0. Restrict to specific destinations. * egress.ipv6_cidr_blocks not contains ::/0 — Security group allows unrestricted outbound access to ::/0 (all IPv6).

Remediation: Replace 0.0.0.0/0 egress rules with specific CIDR ranges or prefix lists. Use VPC endpoints for cloud service access to eliminate the need for internet egress.

Compliant
resource "aws_security_group" "app" {
  name   = "app-sg"
  vpc_id = aws_vpc.main.id
  egress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # Internal only
  }
  # Outbound internet requires Network Firewall / explicit destination
}
Non-Compliant
resource "aws_security_group" "app" {
  name   = "app-sg"
  vpc_id = aws_vpc.main.id
  egress {
    from_port   = 0
    to_port     = 0
    protocol    = "-1"
    cidr_blocks = ["0.0.0.0/0"]  # Unrestricted outbound
  }
}

waf-sov-090.tf.aws.vpc-endpoint-s3

Engine: terraform | Provider: aws | Automated: Yes

VPC must have a gateway endpoint for S3

VPCs containing sovereign workloads should have a gateway endpoint for S3 to ensure S3 API traffic stays on the AWS network backbone, not the public internet. This is both a sovereignty and cost optimization control.

Scope: resource — aws_vpc

Assertions: * id has associated resource — VPC does not have an S3 VPC endpoint. S3 traffic traverses the public internet.

Remediation: Create an aws_vpc_endpoint resource for S3 (gateway type) in each VPC containing sovereign workloads.

Compliant
resource "aws_vpc_endpoint" "s3" {
  vpc_id            = aws_vpc.main.id
  service_name      = "com.amazonaws.${var.aws_region}.s3"
  vpc_endpoint_type = "Gateway"
  route_table_ids   = [aws_route_table.private.id]
  policy            = data.aws_iam_policy_document.s3_endpoint_policy.json
}
Non-Compliant
resource "aws_vpc" "main" {
  cidr_block = "10.0.0.0/16"
  # No S3 VPC endpoint – all S3 traffic via public internet
}

waf-sov-090.tf.aws.vpc-flow-logs-enabled

Engine: terraform | Provider: aws | Automated: Yes

VPC flow logs must be enabled for egress forensics

Every aws_vpc must have VPC flow logs enabled to capture network traffic metadata. This is required for forensic investigation of data exfiltration events and for compliance with audit logging requirements.

Scope: resource — aws_vpc

Assertions: * id has associated resource — VPC does not have flow logs enabled. Network traffic cannot be audited.

Remediation: Create an aws_flow_log resource for each VPC targeting an approved log destination (S3 in sovereign region or CloudWatch with retention policy set).

waf-sov-090.tf.aws.network-acl-no-open-egress

Engine: terraform | Provider: aws | Automated: Yes

Network ACLs should not have open egress rules on all ports

Network ACL egress rules allowing all traffic (port 0-65535) to 0.0.0.0/0 provide no meaningful defense-in-depth for data exfiltration scenarios.

Scope: resource — aws_network_acl_rule

Assertions: * egress not in ['0.0.0.0/0'] — Network ACL has unrestricted egress rule on all ports to 0.0.0.0/0.

Remediation: Restrict network ACL egress rules to specific port ranges and destination CIDRs.

waf-sov-090.tf.azurerm.nsg-no-open-outbound

Engine: terraform | Provider: azurerm | Automated: Yes

Azure NSG must not allow unrestricted outbound traffic

Azure Network Security Groups must not have outbound security rules allowing all traffic (Any/Any) to destination '*' (any destination).

Scope: resource — azurerm_network_security_rule

Assertions: * destination_address_prefix not equals — Azure NSG rule must not allow traffic to any destination ().

Remediation: Replace wildcard destination address prefix ('*') with specific CIDRs or service tags.

waf-sov-090.tf.stackit.network-no-unrestricted-egress

Engine: terraform | Provider: stackit | Automated: Yes

StackIT networks must not allow unrestricted egress

StackIT networks must not have unrestricted egress rules. Define specific CIDR ranges for outbound traffic.

Scope: resource — stackit_network

Assertions: * egress not equals 0.0.0.0/0 — StackIT network has unrestricted egress. Define specific CIDR ranges.

Remediation: Replace wildcard egress rules with specific CIDR ranges in StackIT network configurations.

Compliant
resource "stackit_network" "main" {
  project_id = stackit_project.main.id
  name       = "sovereign-network"
  cidr       = "10.0.0.0/16"
  # Egress controlled via firewall rules
}
Non-Compliant
resource "stackit_network" "main" {
  project_id = stackit_project.main.id
  name       = "network"
  # Unrestricted egress rules
}

waf-sov-090.tf.ovh.network-no-unrestricted-egress

Engine: terraform | Provider: ovh | Automated: Yes

OVH networks must not allow unrestricted egress

OVH cloud networks must not have unrestricted egress rules. Define specific CIDR ranges for outbound traffic.

Scope: resource — ovh_cloud_project_network_private

Assertions: * egress not equals 0.0.0.0/0 — OVH network has unrestricted egress. Define specific CIDR ranges.

Remediation: Replace wildcard egress rules with specific CIDR ranges in OVH network configurations.

Compliant
# OVH networks with restricted egress defined
Non-Compliant
# OVH networks with unrestricted egress

waf-sov-090.tf.hcloud.network-no-unrestricted-egress

Engine: terraform | Provider: hcloud | Automated: Yes

Hetzner Cloud networks must not allow unrestricted egress

Hetzner Cloud networks must not have unrestricted egress rules. Define specific destination CIDR ranges.

Scope: resource — hcloud_network

Assertions: * ip_range not equals 0.0.0.0/0 — Hetzner Cloud network has unrestricted egress. Define specific CIDR ranges.

Remediation: Replace wildcard egress rules with specific CIDR ranges in Hetzner Cloud network configurations.

Compliant
resource "hcloud_network" "main" {
  name       = "sovereign-network"
  ip_range   = "10.0.0.0/16"
  # Egress controlled through firewall rules
}
Non-Compliant
resource "hcloud_network" "main" {
  name       = "network"
  ip_range   = "10.0.0.0/16"
  # Unrestricted egress rules
}

waf-sov-090.tf.google.firewall-no-open-egress

Engine: terraform | Provider: google | Automated: Yes

GCP firewall rules must not allow unrestricted outbound traffic

GCP compute firewall rules with direction = EGRESS must not allow destination_ranges of 0.0.0.0/0 unless explicitly tagged and justified. Default-deny egress policies should be enforced at the VPC level.

Scope: resource — google_compute_firewall

Assertions: * direction equals EGRESS — Only egress firewall rules are checked for unrestricted outbound. * destination_ranges not contains 0.0.0.0/0 — GCP egress firewall rule must not allow unrestricted 0.0.0.0/0 destinations.

Remediation: Avoid 0.0.0.0/0 destination_ranges in egress firewall rules. Use google_compute_firewall_policy rules with priority to deny all egress by default and allow only specific destinations/ports.

Compliant
resource "google_compute_firewall" "deny_egress" {
  name          = "deny-all-egress"
  network       = google_compute_network.main.id
  direction     = "EGRESS"
  priority      = 1000
  deny {
    protocol = "all"
  }
  destination_ranges = ["10.0.0.0/8"]
}
Non-Compliant
resource "google_compute_firewall" "bad_egress" {
  name               = "allow-all-egress"
  network            = google_compute_network.main.id
  direction          = "EGRESS"
  allow {
    protocol = "all"
  }
  destination_ranges = ["0.0.0.0/0"]
}

Evidence

Kind Required Description

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework Controls

GDPR

* Art. 32 – Security of processing (network security) * Art. 44-46 – Transfers to third countries

BSI C5:2020

* SIM-02 – Intrusion detection * OPS-04 – Data management * NET-01 – Network security

BSI C3A:2026

* Dimension 5 – Operational: Network security and monitoring * Dimension 5 – Operational: Disconnect and reconnect capability

EUCS (ENISA)

* IVS-09 – Network security * IVS-10 – Egress filtering

ISO 27001:2022

* A.8.20 – Networks security * A.8.21 – Security of network services * A.8.22 – Segregation of networks