AWS › VPC & Networking

How do security groups and network ACLs differ in how they control traffic to and from resources within a VPC?

Intermediate

Answer

Security groups act as a stateful firewall at the instance level, meaning if you allow inbound traffic, the corresponding outbound response traffic is automatically allowed as well, while network ACLs act as a stateless firewall at the subnet level, meaning you must explicitly define rules for both inbound and outbound traffic separately, and while security groups only support allow rules, network ACLs support both explicit allow and explicit deny rules, giving you an additional layer of control at the subnet boundary.

aws ec2 authorize-security-group-ingress --group-id sg-12345 --protocol tcp --port 443 --cidr 0.0.0.0/0

Real-world example A company uses security groups as the primary line of defense controlling exactly which ports each individual EC2 instance accepts traffic on, while also configuring a network ACL at the subnet level to explicitly block traffic from a specific known malicious IP range as an additional defense in depth measure.

Common follow-ups: Why would you need both security groups and network ACLs if security groups alone can control access?;How do you troubleshoot connectivity issues that might be caused by either layer?

AWS Security Hub & GuardDuty;EC2 & Compute