Slowness through AWS firewall

Rules
, ,
1

We are using suricata rules in AWS firewall , however observed slowness if we forward traffic through AWS firewall.
"pass tls $web_server any → any 443 (tls.sni; dotprefix; content:“xx.yy…com”; nocase; endswith; msg:“http-allow”; sid:500;)

If we configure with tcp and allow “.com” then its working.
“pass tcp $web_server any → any 443 (tls.sni; dotprefix; content:”.com"; nocase; endswith; msg:“http-allow”; sid:500;)

Any idea what could be the issue

2

The difference is tls versus tcp in the rule, and the tls.sni content being longer ?