Lambda Outbound Proxies: Egress Allowlists That Block SSRF Paths

Lambda ENI -> private subnets
 NO default route to NAT for app subnets
 Routes: VPC endpoints (S3/STS/Secrets) + proxy TG
Proxy (egress VPCs) -> NAT -> Internet
 Allowlist: api.stripe.com, api.github.com, ...
 Deny: 169.254.0.0/16, 10.0.0.0/8, 127.0.0.0/8, metadata hostnames

// GOOD: force undici/node through proxy
process.env.HTTPS_PROXY = process.env.EGRESS_PROXY_URL;
process.env.NO_PROXY = "169.254.169.254,localhost,10.0.0.0/8"; // still deny at proxy

// BAD: app constructs http.request to user-supplied URL with no allowlist
import http from "node:http";
export function fetchUserUrl(url: string) {
 return http.get(url); // SSRF classic
}

# illustrative Envoy/RBAC-ish policy
allow_hosts:
 - api.stripe.com
 - hooks.slack.com
 - bedrock-runtime.us-east-1.amazonaws.com
deny_cidrs:
 - 169.254.0.0/16
 - 10.0.0.0/8
 - 172.16.0.0/12
 - 192.168.0.0/16
 - 127.0.0.0/8
require:
 - tls: true
 - methods: [GET, POST, PUT]

import { Agent, fetch } from "undici";

const ALLOW = new Set(["api.stripe.com", "hooks.slack.com"]);

export async function safeFetch(input: string, init?: RequestInit) {
 const u = new URL(input);
 if (u.protocol !== "https:") throw new Error("https_only");
 if (!ALLOW.has(u.hostname)) throw new Error(`host_not_allowed:${u.hostname}`);
 if (u.hostname.endsWith(".internal")) throw new Error("internal_denied");
 return fetch(u, {
 ...init,
 dispatcher: new Agent({ connect: { timeout: 5_000 } }),
 redirect: "error", // open redirects are SSRF helpers
 } as any);
}