{"id":66912,"date":"2026-07-07T09:21:19","date_gmt":"2026-07-07T02:21:19","guid":{"rendered":"https:\/\/aws.cmctelecom.vn\/2026\/07\/03\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/"},"modified":"2026-07-03T16:01:59","modified_gmt":"2026-07-03T09:01:59","slug":"aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong","status":"publish","type":"post","link":"https:\/\/aws.cmctelecom.vn\/en\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/","title":{"rendered":"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng"},"content":{"rendered":"<p>AWS v\u1eeba ra m\u1eaft m\u1ed9t t\u00ednh n\u0103ng quan tr\u1ecdng cho AWS Network Firewall, gi\u00fap c\u00e1c doanh nghi\u1ec7p \u0111\u01a1n gi\u1ea3n h\u00f3a vi\u1ec7c b\u1ea3o m\u1eadt cho c\u00e1c \u1ee9ng d\u1ee5ng container tr\u00ean Amazon Elastic Kubernetes Service (Amazon EKS) v\u00e0 Amazon Elastic Container Service (Amazon ECS). Thay v\u00ec ph\u1ea3i qu\u1ea3n l\u00fd c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean \u0111\u1ecba ch\u1ec9 IP t\u0129nh v\u00e0 d\u1ec5 g\u00e2y l\u1ed7i, gi\u1edd \u0111\u00e2y \u0111\u1ed9i ng\u0169 an ninh c\u00f3 th\u1ec3 \u0111\u1ecbnh ngh\u0129a c\u00e1c ch\u00ednh s\u00e1ch b\u1ea3o m\u1eadt linh ho\u1ea1t d\u1ef1a tr\u00ean c\u00e1c thu\u1ed9c t\u00ednh c\u1ee7a container nh\u01b0 namespace hay labels. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y gi\u00fap t\u0103ng c\u01b0\u1eddng b\u1ea3o m\u1eadt v\u00e0 gi\u1ea3m \u0111\u00e1ng k\u1ec3 g\u00e1nh n\u1eb7ng v\u1eadn h\u00e0nh.<\/p>\n<p>T\u00ednh n\u0103ng m\u1edbi n\u00e0y \u0111\u1eb7c bi\u1ec7t h\u1eefu \u00edch cho c\u00e1c workload AI v\u00e0 Machine Learning (ML) ch\u1ea1y tr\u00ean EKS, nh\u01b0 model inference hay RAG pipeline, v\u1ed1n \u0111\u00f2i h\u1ecfi c\u00e1c bi\u1ec7n ph\u00e1p b\u1ea3o v\u1ec7 t\u01b0\u1eddng l\u1eeda nghi\u00eam ng\u1eb7t t\u01b0\u01a1ng t\u1ef1 c\u00e1c \u1ee9ng d\u1ee5ng truy\u1ec1n th\u1ed1ng. T\u00ednh n\u0103ng n\u00e0y \u0111\u01b0\u1ee3c t\u00edch h\u1ee3p s\u1eb5n trong t\u1ea7ng c\u01a1 b\u1ea3n c\u1ee7a Network Firewall v\u00e0 kh\u00f4ng ph\u00e1t sinh chi ph\u00ed b\u1ed5 sung.<\/p>\n<h2>Th\u00e1ch th\u1ee9c c\u1ee7a vi\u1ec7c b\u1ea3o m\u1eadt container b\u1eb1ng quy t\u1eafc IP truy\u1ec1n th\u1ed1ng<\/h2>\n<p>Trong c\u00e1c m\u00f4i tr\u01b0\u1eddng container h\u00f3a, \u0111\u1ecba ch\u1ec9 IP c\u1ee7a c\u00e1c pod th\u01b0\u1eddng xuy\u00ean thay \u0111\u1ed5i m\u1ed7i khi container \u0111\u01b0\u1ee3c kh\u1edfi \u0111\u1ed9ng l\u1ea1i ho\u1eb7c co gi\u00e3n quy m\u00f4. Vi\u1ec7c vi\u1ebft v\u00e0 duy tr\u00ec c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda t\u0129nh d\u1ef1a tr\u00ean c\u00e1c \u0111\u1ecba ch\u1ec9 IP t\u1ea1m th\u1eddi n\u00e0y l\u00e0 m\u1ed9t c\u00f4ng vi\u1ec7c ph\u1ee9c t\u1ea1p, t\u1ed1n th\u1eddi gian v\u00e0 d\u1ec5 x\u1ea3y ra sai s\u00f3t, c\u00f3 th\u1ec3 t\u1ea1o ra nh\u1eefng l\u1ed7 h\u1ed5ng trong h\u1ec7 th\u1ed1ng ph\u00f2ng th\u1ee7 c\u1ee7a doanh nghi\u1ec7p.<\/p>\n<p>M\u1eb7c d\u00f9 Kubernetes Network Policies cung c\u1ea5p kh\u1ea3 n\u0103ng ki\u1ec3m so\u00e1t l\u01b0u l\u01b0\u1ee3ng c\u01a1 b\u1ea3n \u1edf L\u1edbp 3 v\u00e0 L\u1edbp 4, ch\u00fang th\u01b0\u1eddng kh\u00f4ng \u0111\u1ee7 \u0111\u1ec3 \u0111\u00e1p \u1ee9ng c\u00e1c y\u00eau c\u1ea7u b\u1ea3o m\u1eadt n\u00e2ng cao. Nhi\u1ec1u doanh nghi\u1ec7p c\u1ea7n c\u00e1c t\u00ednh n\u0103ng nh\u01b0 ki\u1ec3m tra s\u00e2u \u1edf L\u1edbp 7, l\u1ecdc l\u01b0u l\u01b0\u1ee3ng d\u1ef1a tr\u00ean t\u00ean mi\u1ec1n (FQDN), v\u00e0 b\u1ea3o v\u1ec7 kh\u1ecfi c\u00e1c m\u1ed1i \u0111e d\u1ecda \u0111\u01b0\u1ee3c ph\u00e1t hi\u1ec7n b\u1edfi c\u00e1c quy t\u1eafc IDS\/IPS. H\u01a1n n\u1eefa, kh\u1ea3 n\u0103ng x\u00e1c \u0111\u1ecbnh ch\u00ednh x\u00e1c pod ho\u1eb7c d\u1ecbch v\u1ee5 n\u00e0o \u0111\u00e3 t\u1ea1o ra l\u01b0u l\u01b0\u1ee3ng b\u1ecb ch\u1eb7n l\u00e0 r\u1ea5t quan tr\u1ecdng \u0111\u1ec3 kh\u1eafc ph\u1ee5c s\u1ef1 c\u1ed1 nhanh ch\u00f3ng v\u00e0 \u0111\u00e1p \u1ee9ng c\u00e1c y\u00eau c\u1ea7u ki\u1ec3m to\u00e1n.<\/p>\n<h2>Gi\u1ea3i ph\u00e1p m\u1edbi: Quy t\u1eafc t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean thu\u1ed9c t\u00ednh container<\/h2>\n<p>T\u00ednh n\u0103ng quy t\u1eafc d\u1ef1a tr\u00ean thu\u1ed9c t\u00ednh container c\u1ee7a AWS Network Firewall gi\u1ea3i quy\u1ebft tr\u1ef1c ti\u1ebfp nh\u1eefng th\u00e1ch th\u1ee9c tr\u00ean. B\u1eb1ng c\u00e1ch t\u1ea1o m\u1ed9t <em>container association<\/em> (li\u00ean k\u1ebft container), Network Firewall c\u00f3 th\u1ec3 t\u1ef1 \u0111\u1ed9ng kh\u00e1m ph\u00e1 v\u00e0 theo d\u00f5i c\u00e1c pod kh\u1edbp v\u1edbi c\u00e1c thu\u1ed9c t\u00ednh \u0111\u01b0\u1ee3c \u0111\u1ecbnh ngh\u0129a (v\u00ed d\u1ee5: namespace, labels, t\u00ean cluster) v\u00e0 chuy\u1ec3n \u0111\u1ed5i ch\u00fang th\u00e0nh c\u00e1c \u0111\u1ecba ch\u1ec9 IP hi\u1ec7n t\u1ea1i.<\/p>\n<p>Khi c\u00e1c pod co gi\u00e3n quy m\u00f4 ho\u1eb7c kh\u1edfi \u0111\u1ed9ng l\u1ea1i, t\u01b0\u1eddng l\u1eeda s\u1ebd t\u1ef1 \u0111\u1ed9ng c\u1eadp nh\u1eadt \u00e1nh x\u1ea1 t\u1eeb IP sang thu\u1ed9c t\u00ednh g\u1ea7n nh\u01b0 trong th\u1eddi gian th\u1ef1c m\u00e0 kh\u00f4ng c\u1ea7n b\u1ea5t k\u1ef3 s\u1ef1 can thi\u1ec7p th\u1ee7 c\u00f4ng n\u00e0o. C\u00e1ch ti\u1ebfp c\u1eadn n\u00e0y \u0111\u1ea3m b\u1ea3o c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda lu\u00f4n ch\u00ednh x\u00e1c trong m\u00f4i tr\u01b0\u1eddng \u0111\u1ed9ng. H\u01a1n n\u1eefa, t\u00ednh n\u0103ng n\u00e0y c\u00f2n l\u00e0m gi\u00e0u (enrich) nh\u1eadt k\u00fd c\u1ea3nh b\u00e1o c\u1ee7a t\u01b0\u1eddng l\u1eeda v\u1edbi ng\u1eef c\u1ea3nh container, cho ph\u00e9p \u0111\u1ed9i ng\u0169 b\u1ea3o m\u1eadt truy v\u1ebft l\u01b0u l\u01b0\u1ee3ng b\u1ecb ch\u1eb7n ho\u1eb7c \u0111\u01b0\u1ee3c cho ph\u00e9p v\u1ec1 \u0111\u00fang workload g\u1ed1c.<\/p>\n<p>C\u00e1c quy t\u1eafc n\u00e0y \u0111\u01b0\u1ee3c \u0111\u1ecbnh ngh\u0129a b\u1eb1ng c\u00fa ph\u00e1p Suricata, cho ph\u00e9p t\u1ea1o ra c\u00e1c ch\u00ednh s\u00e1ch linh ho\u1ea1t. V\u00ed d\u1ee5:<\/p>\n<ul>\n<li><strong>Quy t\u1eafc cho nh\u00f3m pod:<\/strong> Ch\u1ec9 cho ph\u00e9p c\u00e1c pod thu\u1ed9c d\u1ecbch v\u1ee5 thanh to\u00e1n (<code>payment-service<\/code>) k\u1ebft n\u1ed1i \u0111\u1ebfn c\u1ed5ng thanh to\u00e1n b\u00ean ngo\u00e0i qua TLS.<\/li>\n<li><strong>Quy t\u1eafc \u1ee9ng d\u1ee5ng L\u1edbp 7:<\/strong> Ch\u1eb7n t\u1ea5t c\u1ea3 c\u00e1c pod truy c\u1eadp \u0111\u1ebfn c\u00e1c trang web \u0111\u1ed9c h\u1ea1i \u0111\u00e3 bi\u1ebft.<\/li>\n<\/ul>\n<h2>H\u01b0\u1edbng d\u1eabn c\u1ea5u h\u00ecnh v\u00e0 tri\u1ec3n khai<\/h2>\n<p>Doanh nghi\u1ec7p c\u00f3 th\u1ec3 c\u1ea5u h\u00ecnh t\u00ednh n\u0103ng n\u00e0y th\u00f4ng qua AWS Management Console, AWS CLI ho\u1eb7c AWS SDK. Qu\u00e1 tr\u00ecnh n\u00e0y bao g\u1ed3m hai b\u01b0\u1edbc ch\u00ednh:<\/p>\n<p><strong>B\u01b0\u1edbc 1: T\u1ea1o m\u1ed9t Container Association<\/strong><\/p>\n<p>Trong giao di\u1ec7n qu\u1ea3n l\u00fd Amazon VPC, \u0111i\u1ec1u h\u01b0\u1edbng \u0111\u1ebfn m\u1ee5c Network Firewall v\u00e0 t\u1ea1o m\u1ed9t <code>Container association<\/code> m\u1edbi. T\u1ea1i \u0111\u00e2y, b\u1ea1n c\u1ea7n \u0111\u1eb7t t\u00ean, ch\u1ecdn c\u1ee5m EKS v\u00e0 \u0111\u1ecbnh ngh\u0129a c\u00e1c b\u1ed9 l\u1ecdc thu\u1ed9c t\u00ednh (v\u00ed d\u1ee5: <code>namespace: ecommerce<\/code>) \u0111\u1ec3 x\u00e1c \u0111\u1ecbnh c\u00e1c pod c\u1ea7n \u0111\u01b0\u1ee3c li\u00ean k\u1ebft.<\/p>\n<figure class=\"wp-block-image size-large aligncenter\" style=\"text-align:center;margin:1.5em 0;\"><img decoding=\"async\" data-src=\"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/cbe1a8585a.png\" alt=\"H\u00ecnh 1: T\u1ea1o m\u1ed9t container association \u0111\u1ec3 li\u00ean k\u1ebft v\u1edbi c\u1ee5m EKS.\" style=\"--smush-placeholder-width: 1214px; --smush-placeholder-aspect-ratio: 1214\/772;border-radius:8px;border:1px solid #e5e7eb;max-width:100%;max-height:560px;width:auto;height:auto;display:inline-block;\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" class=\"lazyload\"><\/figure>\n<p><strong>B\u01b0\u1edbc 2: T\u1ea1o m\u1ed9t nh\u00f3m quy t\u1eafc t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean thu\u1ed9c t\u00ednh<\/strong><\/p>\n<p>Ti\u1ebfp theo, t\u1ea1o m\u1ed9t <code>Stateful rule group<\/code> m\u1edbi trong Network Firewall. Ch\u1ecdn \u0111\u1ecbnh d\u1ea1ng quy t\u1eafc t\u01b0\u01a1ng th\u00edch v\u1edbi Suricata.<\/p>\n<figure class=\"wp-block-image size-large aligncenter\" style=\"text-align:center;margin:1.5em 0;\"><img decoding=\"async\" data-src=\"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/4141c9fbe6.png\" alt=\"H\u00ecnh 2: L\u1ef1a ch\u1ecdn t\u1ea1o m\u1ed9t nh\u00f3m quy t\u1eafc stateful.\" style=\"--smush-placeholder-width: 1266px; --smush-placeholder-aspect-ratio: 1266\/434;border-radius:8px;border:1px solid #e5e7eb;max-width:100%;max-height:560px;width:auto;height:auto;display:inline-block;\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" class=\"lazyload\"><\/figure>\n<p>\u0110\u1eb7t t\u00ean v\u00e0 m\u00f4 t\u1ea3 cho nh\u00f3m quy t\u1eafc.<\/p>\n<figure class=\"wp-block-image size-large aligncenter\" style=\"text-align:center;margin:1.5em 0;\"><img decoding=\"async\" data-src=\"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/10dd8ab872.png\" alt=\"H\u00ecnh 3: M\u00f4 t\u1ea3 chi ti\u1ebft cho nh\u00f3m quy t\u1eafc.\" style=\"--smush-placeholder-width: 1247px; --smush-placeholder-aspect-ratio: 1247\/431;border-radius:8px;border:1px solid #e5e7eb;max-width:100%;max-height:560px;width:auto;height:auto;display:inline-block;\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" class=\"lazyload\"><\/figure>\n<p>Trong ph\u1ea7n c\u1ea5u h\u00ecnh quy t\u1eafc, t\u1ea1i m\u1ee5c <code>IP set references<\/code>, t\u1ea1o m\u1ed9t bi\u1ebfn (v\u00ed d\u1ee5: <code>@ecommerce_pods<\/code>) v\u00e0 tham chi\u1ebfu \u0111\u1ebfn <code>container association<\/code> \u0111\u00e3 t\u1ea1o \u1edf b\u01b0\u1edbc 1. Sau \u0111\u00f3, vi\u1ebft c\u00e1c chu\u1ed7i quy t\u1eafc Suricata s\u1eed d\u1ee5ng bi\u1ebfn n\u00e0y \u0111\u1ec3 \u00e1p d\u1ee5ng ch\u00ednh s\u00e1ch cho nh\u00f3m pod t\u01b0\u01a1ng \u1ee9ng.<\/p>\n<figure class=\"wp-block-image size-large aligncenter\" style=\"text-align:center;margin:1.5em 0;\"><img decoding=\"async\" data-src=\"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/07db737683.png\" alt=\"H\u00ecnh 4: C\u1ea5u h\u00ecnh quy t\u1eafc Suricata s\u1eed d\u1ee5ng bi\u1ebfn tham chi\u1ebfu \u0111\u1ebfn container association.\" style=\"--smush-placeholder-width: 1626px; --smush-placeholder-aspect-ratio: 1626\/792;border-radius:8px;border:1px solid #e5e7eb;max-width:100%;max-height:560px;width:auto;height:auto;display:inline-block;\" src=\"data:image\/svg+xml;base64,PHN2ZyB3aWR0aD0iMSIgaGVpZ2h0PSIxIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjwvc3ZnPg==\" class=\"lazyload\"><\/figure>\n<p>Sau khi t\u1ea1o v\u00e0 \u00e1p d\u1ee5ng nh\u00f3m quy t\u1eafc, Network Firewall s\u1ebd b\u1eaft \u0111\u1ea7u l\u1ecdc l\u01b0u l\u01b0\u1ee3ng theo c\u00e1c ch\u00ednh s\u00e1ch \u0111\u00e3 \u0111\u1ecbnh ngh\u0129a.<\/p>\n<h2>M\u1ed9t s\u1ed1 l\u01b0u \u00fd quan tr\u1ecdng<\/h2>\n<p>Khi \u00e1p d\u1ee5ng t\u00ednh n\u0103ng n\u00e0y, doanh nghi\u1ec7p c\u1ea7n l\u01b0u \u00fd m\u1ed9t v\u00e0i \u0111i\u1ec3m quan tr\u1ecdng:<\/p>\n<ul>\n<li><strong>V\u00f4 hi\u1ec7u h\u00f3a SNAT:<\/strong> C\u1ea7n ph\u1ea3i t\u1eaft <em>Source NAT<\/em> (SNAT) \u0111\u1ec3 Network Firewall c\u00f3 th\u1ec3 th\u1ea5y \u0111\u01b0\u1ee3c \u0111\u1ecba ch\u1ec9 IP th\u1ef1c c\u1ee7a pod. N\u1ebfu SNAT v\u1eabn \u0111\u01b0\u1ee3c b\u1eadt, t\u01b0\u1eddng l\u1eeda s\u1ebd ch\u1ec9 th\u1ea5y \u0111\u1ecba ch\u1ec9 IP c\u1ee7a node, l\u00e0m m\u1ea5t \u0111i kh\u1ea3 n\u0103ng ki\u1ec3m so\u00e1t chi ti\u1ebft \u1edf c\u1ea5p \u0111\u1ed9 pod.<\/li>\n<li><strong>L\u01b0u l\u01b0\u1ee3ng pod-to-pod:<\/strong> T\u00ednh n\u0103ng n\u00e0y kh\u00f4ng th\u1ec3 th\u1ef1c thi ch\u00ednh s\u00e1ch cho l\u01b0u l\u01b0\u1ee3ng gi\u1eefa c\u00e1c pod tr\u00ean c\u00f9ng m\u1ed9t node, v\u00ec l\u01b0u l\u01b0\u1ee3ng n\u00e0y kh\u00f4ng \u0111i qua endpoint c\u1ee7a Network Firewall.<\/li>\n<li><strong>T\u00e1c \u0111\u1ed9ng hi\u1ec7u n\u0103ng:<\/strong> Hi\u1ec7u n\u0103ng c\u00f3 th\u1ec3 b\u1ecb \u1ea3nh h\u01b0\u1edfng t\u00f9y thu\u1ed9c v\u00e0o \u0111\u1ed9 ph\u1ee9c t\u1ea1p c\u1ee7a quy t\u1eafc v\u00e0 kh\u1ed1i l\u01b0\u1ee3ng l\u01b0u l\u01b0\u1ee3ng truy c\u1eadp.<\/li>\n<\/ul>\n<h2>K\u1ebft lu\u1eadn<\/h2>\n<p>Quy t\u1eafc d\u1ef1a tr\u00ean thu\u1ed9c t\u00ednh container c\u1ee7a AWS Network Firewall l\u00e0 m\u1ed9t b\u01b0\u1edbc ti\u1ebfn l\u1edbn trong vi\u1ec7c b\u1ea3o m\u1eadt c\u00e1c workload container \u0111\u1ed9ng. B\u1eb1ng c\u00e1ch lo\u1ea1i b\u1ecf s\u1ef1 ph\u1ee5 thu\u1ed9c v\u00e0o c\u00e1c \u0111\u1ecba ch\u1ec9 IP t\u1ea1m th\u1eddi v\u00e0 cho ph\u00e9p \u0111\u1ecbnh ngh\u0129a ch\u00ednh s\u00e1ch d\u1ef1a tr\u00ean c\u00e1c thu\u1ed9c t\u00ednh logic c\u1ee7a Kubernetes, AWS gi\u00fap c\u00e1c doanh nghi\u1ec7p t\u0103ng c\u01b0\u1eddng an ninh, c\u1ea3i thi\u1ec7n kh\u1ea3 n\u0103ng gi\u00e1m s\u00e1t v\u00e0 gi\u1ea3m thi\u1ec3u \u0111\u00e1ng k\u1ec3 c\u00f4ng s\u1ee9c qu\u1ea3n l\u00fd th\u1ee7 c\u00f4ng, t\u1eeb \u0111\u00f3 t\u1eadp trung h\u01a1n v\u00e0o vi\u1ec7c ph\u00e1t tri\u1ec3n \u1ee9ng d\u1ee5ng.<\/p>","protected":false},"excerpt":{"rendered":"<p>AWS v\u1eeba ra m\u1eaft m\u1ed9t t\u00ednh n\u0103ng quan tr\u1ecdng cho AWS Network Firewall, gi\u00fap c\u00e1c doanh nghi\u1ec7p \u0111\u01a1n gi\u1ea3n h\u00f3a vi\u1ec7c b\u1ea3o m\u1eadt cho c\u00e1c \u1ee9ng d\u1ee5ng container tr\u00ean Amazon Elastic Kubernetes Service (Amazon EKS) v\u00e0 Amazon Elastic Container Service (Amazon ECS). Thay v\u00ec ph\u1ea3i qu\u1ea3n l\u00fd c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean \u0111\u1ecba&#8230;<\/p>","protected":false},"author":22,"featured_media":66907,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-66912","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctelers-blogs"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.9 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng | CMC Telecom<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/aws.cmctelecom.vn\/en\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng | CMC Telecom\" \/>\n<meta property=\"og:description\" content=\"AWS v\u1eeba ra m\u1eaft m\u1ed9t t\u00ednh n\u0103ng quan tr\u1ecdng cho AWS Network Firewall, gi\u00fap c\u00e1c doanh nghi\u1ec7p \u0111\u01a1n gi\u1ea3n h\u00f3a vi\u1ec7c b\u1ea3o m\u1eadt cho c\u00e1c \u1ee9ng d\u1ee5ng container tr\u00ean Amazon Elastic Kubernetes Service (Amazon EKS) v\u00e0 Amazon Elastic Container Service (Amazon ECS). Thay v\u00ec ph\u1ea3i qu\u1ea3n l\u00fd c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean \u0111\u1ecba...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/aws.cmctelecom.vn\/en\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/\" \/>\n<meta property=\"og:site_name\" content=\"CMC Telecom\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/CMCTelecomOfficial\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-07T02:21:19+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"731\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"publisher-bot\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"publisher-bot\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"8 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/\"},\"author\":{\"name\":\"publisher-bot\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#\\\/schema\\\/person\\\/630c0582c38b5246ea44d055155d721e\"},\"headline\":\"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng\",\"datePublished\":\"2026-07-07T02:21:19+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/\"},\"wordCount\":1620,\"publisher\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg\",\"articleSection\":[\"Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/\",\"url\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/\",\"name\":\"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng | CMC Telecom\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg\",\"datePublished\":\"2026-07-07T02:21:19+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#primaryimage\",\"url\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg\",\"contentUrl\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg\",\"width\":1280,\"height\":731},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/2026\\\/07\\\/07\\\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Trang ch\u1ee7\",\"item\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Blogs\",\"item\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/en\\\/danh-muc-tin-tuc\\\/ctelers-blogs\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#website\",\"url\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/\",\"name\":\"CMC Telecom\",\"description\":\"\u0110\u1ed1i t\u00e1c D\u1ecbch v\u1ee5 C\u1ea5p cao c\u1ee7a AWS t\u1ea1i Vi\u1ec7t Nam\",\"publisher\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#organization\"},\"alternateName\":\"AWS Advanced Partner in Vietnam\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#organization\",\"name\":\"CMC Telecom\",\"alternateName\":\"CMC Telecom\",\"url\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/wp-content\\\/uploads\\\/2023\\\/07\\\/cmc-telecom-logo.png\",\"contentUrl\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/wp-content\\\/uploads\\\/2023\\\/07\\\/cmc-telecom-logo.png\",\"width\":400,\"height\":96,\"caption\":\"CMC Telecom\"},\"image\":{\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/CMCTelecomOfficial\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/#\\\/schema\\\/person\\\/630c0582c38b5246ea44d055155d721e\",\"name\":\"publisher-bot\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/83ecf50e74202a2c7d2e2c924c1d66b874db607a909c8236b74cc4fb96581a00?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/83ecf50e74202a2c7d2e2c924c1d66b874db607a909c8236b74cc4fb96581a00?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/83ecf50e74202a2c7d2e2c924c1d66b874db607a909c8236b74cc4fb96581a00?s=96&d=mm&r=g\",\"caption\":\"publisher-bot\"},\"url\":\"https:\\\/\\\/aws.cmctelecom.vn\\\/en\\\/author\\\/publisher-bot\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng | CMC Telecom","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/aws.cmctelecom.vn\/en\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/","og_locale":"en_US","og_type":"article","og_title":"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng | CMC Telecom","og_description":"AWS v\u1eeba ra m\u1eaft m\u1ed9t t\u00ednh n\u0103ng quan tr\u1ecdng cho AWS Network Firewall, gi\u00fap c\u00e1c doanh nghi\u1ec7p \u0111\u01a1n gi\u1ea3n h\u00f3a vi\u1ec7c b\u1ea3o m\u1eadt cho c\u00e1c \u1ee9ng d\u1ee5ng container tr\u00ean Amazon Elastic Kubernetes Service (Amazon EKS) v\u00e0 Amazon Elastic Container Service (Amazon ECS). Thay v\u00ec ph\u1ea3i qu\u1ea3n l\u00fd c\u00e1c quy t\u1eafc t\u01b0\u1eddng l\u1eeda d\u1ef1a tr\u00ean \u0111\u1ecba...","og_url":"https:\/\/aws.cmctelecom.vn\/en\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/","og_site_name":"CMC Telecom","article_publisher":"https:\/\/www.facebook.com\/CMCTelecomOfficial","article_published_time":"2026-07-07T02:21:19+00:00","og_image":[{"width":1280,"height":731,"url":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg","type":"image\/jpeg"}],"author":"publisher-bot","twitter_card":"summary_large_image","twitter_misc":{"Written by":"publisher-bot","Est. reading time":"8 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#article","isPartOf":{"@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/"},"author":{"name":"publisher-bot","@id":"https:\/\/aws.cmctelecom.vn\/#\/schema\/person\/630c0582c38b5246ea44d055155d721e"},"headline":"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng","datePublished":"2026-07-07T02:21:19+00:00","mainEntityOfPage":{"@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/"},"wordCount":1620,"publisher":{"@id":"https:\/\/aws.cmctelecom.vn\/#organization"},"image":{"@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#primaryimage"},"thumbnailUrl":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg","articleSection":["Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/","url":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/","name":"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng | CMC Telecom","isPartOf":{"@id":"https:\/\/aws.cmctelecom.vn\/#website"},"primaryImageOfPage":{"@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#primaryimage"},"image":{"@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#primaryimage"},"thumbnailUrl":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg","datePublished":"2026-07-07T02:21:19+00:00","breadcrumb":{"@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#primaryimage","url":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg","contentUrl":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2026\/07\/secure-amazon-container-workloads-using-container-attribute-based-rules-in-aws-network-firewall.thumbnail.jpg","width":1280,"height":731},{"@type":"BreadcrumbList","@id":"https:\/\/aws.cmctelecom.vn\/2026\/07\/07\/aws-network-firewall-bao-mat-workload-container-bang-quy-tac-dong\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Trang ch\u1ee7","item":"https:\/\/aws.cmctelecom.vn\/"},{"@type":"ListItem","position":2,"name":"Blogs","item":"https:\/\/aws.cmctelecom.vn\/en\/danh-muc-tin-tuc\/ctelers-blogs\/"},{"@type":"ListItem","position":3,"name":"AWS Network Firewall: B\u1ea3o m\u1eadt workload container b\u1eb1ng quy t\u1eafc \u0111\u1ed9ng"}]},{"@type":"WebSite","@id":"https:\/\/aws.cmctelecom.vn\/#website","url":"https:\/\/aws.cmctelecom.vn\/","name":"CMC Telecom","description":"CMC Telecom holds the position of a Advanced Tier Service Partner of AWS in Vietnam and has closely","publisher":{"@id":"https:\/\/aws.cmctelecom.vn\/#organization"},"alternateName":"AWS Advanced Partner in Vietnam","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/aws.cmctelecom.vn\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/aws.cmctelecom.vn\/#organization","name":"CMC Telecom","alternateName":"CMC Telecom","url":"https:\/\/aws.cmctelecom.vn\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/aws.cmctelecom.vn\/#\/schema\/logo\/image\/","url":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2023\/07\/cmc-telecom-logo.png","contentUrl":"https:\/\/aws.cmctelecom.vn\/wp-content\/uploads\/2023\/07\/cmc-telecom-logo.png","width":400,"height":96,"caption":"CMC Telecom"},"image":{"@id":"https:\/\/aws.cmctelecom.vn\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/CMCTelecomOfficial"]},{"@type":"Person","@id":"https:\/\/aws.cmctelecom.vn\/#\/schema\/person\/630c0582c38b5246ea44d055155d721e","name":"publisher-bot","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/83ecf50e74202a2c7d2e2c924c1d66b874db607a909c8236b74cc4fb96581a00?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/83ecf50e74202a2c7d2e2c924c1d66b874db607a909c8236b74cc4fb96581a00?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/83ecf50e74202a2c7d2e2c924c1d66b874db607a909c8236b74cc4fb96581a00?s=96&d=mm&r=g","caption":"publisher-bot"},"url":"https:\/\/aws.cmctelecom.vn\/en\/author\/publisher-bot\/"}]}},"_links":{"self":[{"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/posts\/66912","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/users\/22"}],"replies":[{"embeddable":true,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/comments?post=66912"}],"version-history":[{"count":1,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/posts\/66912\/revisions"}],"predecessor-version":[{"id":66917,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/posts\/66912\/revisions\/66917"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/media\/66907"}],"wp:attachment":[{"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/media?parent=66912"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/categories?post=66912"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/aws.cmctelecom.vn\/en\/wp-json\/wp\/v2\/tags?post=66912"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}