通信制限（エグレス） - ネットワーク通信制限（エグレス制御）

# デフォルトでアウトバウンドを全拒否
iptables -P OUTPUT DROP

# DNS（53）を許可
iptables -A OUTPUT -p udp --dport 53 -d 10.0.0.2 -j ACCEPT
iptables -A OUTPUT -p tcp --dport 53 -d 10.0.0.2 -j ACCEPT

# HTTPS（443）を許可
iptables -A OUTPUT -p tcp --dport 443 -j ACCEPT

# 確立済みコネクションの応答を許可
iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# AWS Security Group - アウトバウンドルール（Terraform）
resource "aws_security_group_rule" "egress_https" {
  type              = "egress"
  from_port         = 443
  to_port           = 443
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]
  security_group_id = aws_security_group.app.id
  description       = "Allow HTTPS outbound"
}

resource "aws_security_group_rule" "egress_deny_all" {
  type              = "egress"
  from_port         = 0
  to_port           = 0
  protocol          = "-1"
  cidr_blocks       = []
  security_group_id = aws_security_group.app.id
  description       = "Deny all other outbound"
}

# Kubernetes NetworkPolicy - エグレス制御
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: restrict-egress
  namespace: production
spec:
  podSelector:
    matchLabels:
      app: backend
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: database
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - ipBlock:
            cidr: 10.0.0.2/32
      ports:
        - protocol: UDP
          port: 53