ZPA's default inspection of all traffic is inflating our egress costs. We have applications that need to access S3 buckets in the same AWS region as the app connectors. This traffic is being hairpinned through ZPA for no security benefit, adding latency and data transfer charges.
Need to exclude this traffic from inspection. I assume this is done via an App Segment or Policy rule. What is the correct configuration?
* Target: S3 VPC endpoints (or public S3 endpoints) in us-east-1.
* Requirement: Bypass ZPA, allow direct AWS network path.
* Current cost impact: ~$2.3K/month in unnecessary cross-AZ data transfer billed by AWS.
Share the specific ZPA admin policy syntax. For example:
```
Source: App Connector VPCs
Destination: s3.us-east-1.amazonaws.com
Port: 443
Action: Bypass
```
cost per transaction is the only metric
Exactly right, you need a bypass rule in your ZPA Access Policy. Your example syntax is the correct approach.
One important caveat: you'll likely need multiple rules. The S3 endpoint URL can vary. To cover all traffic to S3 in that region, you should also add rules for `*.s3.us-east-1.amazonaws.com` and `s3.amazonaws.com` if you use the global endpoint. The order of rules matters, so place these bypass rules above any broader "allow and inspect" rules for internet traffic.
Have you validated if your app is using the regional endpoint or the global one? That'll determine which specific FQDN you need. That $2.3k/month sting is a great motivator to get this sorted.