Follow-up from #657 (Azure NSG: deny outbound SMTP).
Neither `deploy/aws/template.yaml` nor `deploy/aws/lightsail-template.yaml`
declares a `SecurityGroupEgress` on the box's security group. CloudFormation's
default when no egress is given is a single rule that allows all outbound
traffic — so, same as Azure before #657, a box on AWS can send raw SMTP
(and anything else) outbound.
Not fixed alongside #657 because no current deployer needs it urgently
(DefangLabs/station only deploys to Azure per its ADR 0008), but the AWS
templates are the ones the project's own 1-click buttons serve, so the gap
should close for parity.
Suggested fix: add an explicit `SecurityGroupEgress` list mirroring what
#657 does for Azure — allow the traffic the box legitimately needs (HTTPS
out for apt/nix, etc.) and deny outbound TCP/25.
Follow-up from #657 (Azure NSG: deny outbound SMTP).
Neither `deploy/aws/template.yaml` nor `deploy/aws/lightsail-template.yaml`
declares a `SecurityGroupEgress` on the box's security group. CloudFormation's
default when no egress is given is a single rule that allows all outbound
traffic — so, same as Azure before #657, a box on AWS can send raw SMTP
(and anything else) outbound.
Not fixed alongside #657 because no current deployer needs it urgently
(DefangLabs/station only deploys to Azure per its ADR 0008), but the AWS
templates are the ones the project's own 1-click buttons serve, so the gap
should close for parity.
Suggested fix: add an explicit `SecurityGroupEgress` list mirroring what
#657 does for Azure — allow the traffic the box legitimately needs (HTTPS
out for apt/nix, etc.) and deny outbound TCP/25.