Network ACLs vs Security Groups

AWS provides two distinct firewall mechanisms within a VPC. Security Groups operate at the instance level (technically at the ENI level) and are stateful. Network Access Control Lists (NACLs) operate at the subnet level and are stateless. Both are evaluated for any traffic entering or leaving a subnet and its associated instances. Using both in concert provides defence-in-depth: NACLs as a first line at the subnet boundary, security groups as the per-instance firewall. The SAA-C03 exam frequently compares these two mechanisms.

A Network ACL (NACL) is a numbered list of rules applied to all traffic crossing the boundary of a subnet. NACLs are stateless—each packet is evaluated independently. If you allow inbound TCP port 80, you must explicitly allow outbound return traffic (ephemeral ports 1024-65535) for the response to leave the subnet. Rules are evaluated in numerical order (lowest number first); the first matching rule applies and no further rules are checked. Each VPC comes with a default NACL that allows all inbound and outbound traffic.