Network Firewall adds EKS and ECS attribute-based rules

AWS Network Firewall added container attribute-based inspection on June 30, allowing policies to identify EKS and ECS workloads through container-related attributes rather than only tracking IP addresses.

Policy follows workload metadata

The announcement lists EKS namespaces, cluster names, and labels, alongside ECS cluster names and container instance attributes. AWS describes using those selectors with inspection and filtering capabilities as workloads scale.

The operational appeal is straightforward: a firewall policy can describe a class of workloads while individual instances change. For teams maintaining frequent IP-based updates, that is a different policy-management workflow to assess.

Our analysis: the reliability of an attribute-based rule depends on the governance of the attribute. If a developer or automation can freely change a label used to select privileged network access, the label has become part of the security boundary.

Review who can change selectors

Inventory the fields each proposed rule uses and identify every actor that can write them. Review deployment pipelines, admission controls, administrative roles, and emergency procedures together. A network policy review that ignores those writers will be incomplete.

Test a rollout in which workloads temporarily carry old, new, and missing attributes. Observe which connections succeed, which fail, and whether the resulting logs identify the workload clearly enough for incident response.

Also verify the traffic path. A correctly written policy is useful only for traffic that reaches the intended inspection point. Start with one application and a small set of allowed destinations, then test scaling, replacement, and metadata mistakes. The result should be a policy whose meaning stays clear while the underlying containers change.