Prevent data exfiltration: AWS egress controls for cloud workloads

This guidance explains a layered egress security strategy for AWS environments—covering a hub-and-spoke Transit Gateway architecture with centralized AWS Network Firewall, Route 53 Resolver DNS Firewall, and data perimeter controls (SCPs/RCPs/VPC endpoint policies)—and recommends detective controls (GuardDuty, IAM Access Analyzer, Security Hub) and automated remediation to detect and prevent data exfiltration, including threats from manipulated agentic AI workloads.