Some request missing SNI field

We are trying to implement a whitelist for AWS Network Firewall for Egress filtering. A majority of the requests coming from CodeDeploy agent do properly have SNI such that Surricata rules can use tls.sni to filter and whitelist the requests. However, there are many requests to codedeploy-commands.{region}.amazonaws.com that do not contain tls.sni field during ssl hello. We were hoping to keep all aws traffic internal, but it doesn't seem like codedeploy has a vpc endpoint option.

My uneducated guess is that some one off request, [maybe the validation of the certificate](https://github.com/aws/aws-codedeploy-agent/blob/main/lib/instance_agent/plugins/codedeploy/codedeploy_control.rb#L70)(?), is not utilizing SNI.

Inizia da lib/instance_agent/plugins/codedeploy/codedeploy_control.rb intorno alla riga 70 e traccia le richieste effettuate a codedeploy-commands.{region}.amazonaws.com. Confronta le richieste che includono SNI con quelle che non lo includono, concentrandoti sul percorso sospetto di convalida del certificato. Il lavoro è completato quando viene identificata la richiesta responsabile dell’assenza di SNI e viene confermata una causa lato agent oppure viene documentato che è esterna all’agent.

Scritto dal modello di indicizzazione a partire dal testo della issue.