AWS Network Firewall - TLS Egress Configuration Redesign
Designed new TLS inspection features for AWS Network Firewall, simplifying certificate management and helping customers configure secure outbound traffic.
Role
Tools
Team
Project Overview
AWS Network Firewall is a cloud security service that helps organizations protect their networks by monitoring and controlling traffic. TLS inspection allows customers to inspect encrypted traffic, but configuring certificates for outbound connections introduced technical complexity and potential errors.
As the UX Designer for TLS Egress, I designed new certificate authority and certificate revocation features to simplify configuration, improve error prevention, and give customers greater control over outbound traffic inspection. Working closely with engineering, I delivered designs across more than five console pages within a three-month development timeline.
2
New TLS Features Designed
5+
Console Pages Designed
1
Month Early Design Sign-Off
Problem Statement
AWS Network Firewall customers needed a more flexible way to inspect encrypted outbound traffic. Existing certificate-management requirements created additional configuration complexity, while the new TLS Egress capabilities introduced technical requirements that needed to be translated into a clear, usable experience.
Key challenges included:
Complex certificate management: Customers needed to configure certificates correctly for inbound and outbound TLS inspection, including selecting a certificate authority for outbound traffic.
Unclear configuration requirements: Customers needed guidance to understand which certificates were required before they could proceed.
Risk of configuration errors: Missing certificate associations could prevent customers from completing TLS inspection setup.
Certificate revocation handling: Customers needed a way to specify how traffic should be handled when certificate revocation checks failed or returned an unknown status.
Tight delivery timeline: The team had three months to deliver the requested capabilities for a key customer, making efficient collaboration and timely design decisions essential.
Research & Discovery
I reviewed technical documentation and collaborated with engineering to understand TLS inspection requirements, certificate management, and configuration constraints. These findings informed the design of two new features within the AWS Network Firewall console.
2
Features Analyzed
5+
Console Pages in Scope
3
Month Timeline
Key Findings
Outbound TLS inspection required certificate authority integration to support dynamically generated certificates.
Customers needed control over traffic handling when certificate revocation checks failed or returned an unknown status.
Missing certificate associations could prevent customers from completing configuration.
Clear guidance and actionable error states were essential to reducing configuration mistakes.
New features needed to follow established AWS console design patterns.
Ideation
I explored ways to integrate outbound TLS inspection capabilities into the existing AWS Network Firewall experience. Working with engineering and UX stakeholders, I focused on simplifying certificate selection, introducing certificate revocation settings, and maintaining consistency with AWS Cloudscape design patterns.
The direction centered on clear configuration steps, contextual guidance, and actionable error messages to help customers understand requirements and resolve issues before completing setup.
User Flow
I mapped the TLS inspection configuration journey to incorporate new outbound certificate management capabilities while maintaining a familiar AWS workflow. The flow guides customers through certificate association, inspection settings, optional configurations, and final review.
The configuration flow follows these steps:
Associate SSL/TLS certificates
Describe TLS inspection configuration
Define scope
Configure advanced settings (optional)
Add tags (optional)
Review and create
Wireframing
Organized complex TLS inspection settings into a guided, six-step workflow with clearer certificate management and configuration review.
I explored how to simplify the TLS inspection configuration process through a guided, six-step wizard. The wireframes focused on organizing certificate selection, clarifying configuration options, and supporting users through complex tasks such as managing multiple certificates and configuring advanced security settings. I also explored dropdown interactions, conditional fields, and review screens to help users navigate the process with greater clarity.
Interface Design
Using AWS Cloudscape Design System 3.0, I designed a guided interface for configuring TLS inspection settings with clear information hierarchy, consistent components, and progressive disclosure.
The interface organized certificate selection, configuration details, scope definition, and advanced security settings into a six-step workflow. I incorporated contextual guidance, expandable configuration options, and a consolidated review screen to make complex security configurations easier to navigate and verify before creation.
Iterations & Refinements
Refinement 1: Certificate Management
Organized inbound server certificates and outbound CA certificates into separate sections, with clear labels, certificate selection controls, and the ability to add or remove multiple certificates.
Refinement 2: Progressive Disclosure
Separated advanced security settings from essential configuration tasks. Optional encryption settings and certificate revocation controls allowed users to access additional options when needed without overwhelming the primary workflow.
Refinement 3: Configuration Review
Introduced a consolidated review screen displaying certificate selections, configuration details, scope, advanced settings, and tags. Users could review their selections and return to individual steps to make changes before creating the TLS inspection configuration.
Final Design
The final design simplifies AWS Network Firewall’s TLS inspection configuration process through a guided six-step workflow, making complex certificate and security settings easier to navigate and manage. Key features include:
Six-step guided workflow with clear progress navigation
Simplified certificate selection for inbound and outbound SSL/TLS inspection
Improved information hierarchy and field organization
Contextual guidance and validation for certificate requirements
Optional advanced encryption and certificate revocation settings
Consolidated review page with options to edit previous steps
Consistent interface built with the AWS Cloudscape Design System
Impact
Lessons Learned
Design for security and usability. Simplifying certificate management should never compromise essential security controls.
Clear guidance reduces complexity. Contextual instructions help users understand technical configuration requirements.
Flexibility supports different needs. Supporting inbound and outbound certificates accommodates different inspection scenarios.
Consistency improves usability. Leveraging AWS Cloudscape patterns creates a familiar experience across security workflows.
Next Steps
Conduct usability testing with AWS customers to identify friction points in certificate selection and TLS configuration.
Analyze configuration errors, completion rates, and time on task to evaluate usability.
Refine certificate management and security settings based on customer feedback.
Explore smarter defaults and contextual guidance for complex security decisions.
Continue improving accessibility and consistency across AWS Network Firewall experiences.
