Security Groups and NACLs

Securing your AWS resources is crucial. Think of your cloud environment as a house – you need good locks on the doors and windows.

In AWS, two key services act as virtual firewalls to protect your instances and subnets: Security Groups and Network Access Control Lists (NACLs).

A Security Group acts as a virtual firewall for your EC2 instances (or other resources like RDS instances or Load Balancers).

It controls inbound and outbound traffic at the instance level. When you launch an EC2 instance, you associate one or more security groups with it.

Security Groups have rules that specify which traffic is allowed to reach your instances (inbound) and which traffic your instances can send out (outbound).

• Inbound Rules: Define what traffic can enter your instance.
• Outbound Rules: Define what traffic can leave your instance.

By default, outbound traffic is usually allowed, but inbound traffic is denied.

A key characteristic of Security Groups is that they are stateful.

This means if you allow an inbound request (e.g., a web request to your server), the Security Group automatically allows the corresponding outbound response to flow back, even if there isn't an explicit outbound rule for it.

It remembers the connection's "state."

A Network Access Control List (NACL) acts as a virtual firewall for your subnets. It controls traffic entering and exiting the entire subnet.

Unlike Security Groups, NACLs are applied to subnets, meaning all instances within that subnet are subject to its rules.

NACLs have numbered rules that are evaluated in order, from lowest to highest. When a rule matches traffic, it's applied, and no further rules are evaluated.

NACLs can explicitly allow or deny traffic. Every NACL also has a default deny rule (*) at the end to catch any unmatched traffic.

Another key difference: NACLs are stateless.

If you allow inbound traffic, you MUST explicitly create a separate outbound rule to allow the response traffic to return. If you don't, the response will be blocked.

This means you need rules for both directions for any connection.

• Scope: SG for instances, NACL for subnets.
• State: SG is stateful, NACL is stateless.
• Rules: SG only allows, NACL allows AND denies.
• Evaluation: SG evaluates all rules, NACL evaluates by rule number (lowest first).
• Default: SG denies inbound, allows outbound. NACL allows all by default, then denies all with * rule.

It's best practice to use both Security Groups and NACLs together for layered security:

• Use NACLs to broadly filter traffic at the subnet boundary, blocking known malicious IPs or port ranges.
• Use Security Groups to provide fine-grained control for specific instances, allowing only necessary traffic to reach them.

This creates a robust defense-in-depth strategy.

You have an EC2 instance in a public subnet. You want to allow SSH (port 22) and HTTP (port 80) traffic to reach it from anywhere, and block all other incoming traffic.

Great job! You've learned about two fundamental AWS networking security tools:

• Security Groups: Stateful firewalls for instances, allowing specific inbound/outbound traffic.
• Network ACLs (NACLs): Stateless firewalls for subnets, allowing/denying traffic based on rule order.

Understanding these helps you build a strong, multi-layered defense for your AWS resources. Next, we'll explore IAM Roles and Policies for fine-grained access control.