Default-deny network egress architecture in a virtual private cloud

A computer system comprising:

• a processor,
• a network interface, and
• a memory storing instructions executed by the processor to perform actions including:
• configuring the first subnet in the private computer network, the first subnet associated with one or more computer devices that include a private network address translation (NAT) gateway and a private elastic network interface (ENI), to perform egress control including operations of:
• receiving, from a second subnet from at least a second subnet, the traffic destined to the public computer network, and
• in response to the traffic not being authorized to egress to the public computer network, routing, by the private NAT gateway, the traffic to the private ENI, and discarding the traffic at the private ENI;
• logging, at the private ENI, information associated with the traffic in a flow log associated with the blackhole subnet;
• receiving additional traffic from the second subnet;
• determining that the additional traffic is destined to the public computer network;
• determining that the additional traffic includes a type of data qualifying as an exception from being discarded wherein the type of data includes data traffic related to core cloud services;
• and
• routing the additional traffic to the public computer network.

A non-transitory computer-readable storage medium storing computer-readable instructions, that when executed by a processor, cause the processor to perform operations including:

• configuring a network access control list (NACL) of a first subnet in a private computer network to deny a traffic destined to a public computer network, the first subnet comprising a blackhole subnet;
• and
• configuring the first subnet in the private computer network, the first subnet associated with one or more computer devices that include a private network address translation (NAT) gateway and a private elastic network interface (ENI), to perform egress control including operations of:
• receiving, from a second subnet in the private computer network, the traffic destined to the public computer network,
• in response to the traffic not being authorized to egress to the public computer network, routing, by the private NAT gateway, the traffic to the private ENI, and discarding the traffic at the private ENI;
• logging, at the private ENI, information associated with the traffic in a flow log associated with the blackhole subnet;
• receiving additional traffic from the second subnet;
• determining that the additional traffic is destined to the public computer network;
• determining that the additional traffic includes a type of data qualifying as an exception from being discarded wherein the type of data includes data traffic related to core cloud services;
• and
• routing the additional traffic to the public computer network.