AWS Urges Organizations to Turn Outbound Blind Spots Into Monitored Checkpoints

This advisory warns that AWS environments often lack adequate outbound (egress) controls, creating a blind spot for data exfiltration and command-and-control channels. It cites exploitation activity following CVE-2025-55182 and heightened risk from agentic AI, and recommends a hub-and-spoke egress architecture using AWS Network Firewall, Route 53 Resolver DNS Firewall, data perimeter policies (SCPs/RCPs, VPC endpoint policies), centralized detection (GuardDuty, Security Hub, IAM Access Analyzer) and automated response (EventBridge, Lambda, Firewall Manager) to convert egress into a monitored control plane.