2.5 Network Security
Key Takeaways
- Security Groups are stateful, instance-level firewalls that support Allow rules only — return traffic is automatically allowed.
- Network ACLs are stateless, subnet-level firewalls that support both Allow and Deny rules and require explicit inbound AND outbound rules.
- A VPC is an isolated virtual network; public subnets use an Internet Gateway while private subnets use a NAT Gateway for outbound-only internet access.
- VPC endpoints provide private access to AWS services without the internet — Gateway Endpoints for S3/DynamoDB, Interface Endpoints (PrivateLink) for most others.
- Direct Connect is a dedicated private link, VPN is an encrypted internet tunnel, and Transit Gateway interconnects many VPCs and on-premises networks.
Security Groups vs. Network ACLs
Understanding the difference between Security Groups and Network ACLs (NACLs) is one of the most reliably tested topics on the exam. Both control network traffic in a VPC, but they operate differently.
Security Groups (Instance-Level Firewall)
A Security Group is a virtual firewall at the instance level (specifically the network interface).
| Feature | Detail |
|---|---|
| Level | Instance (network interface) |
| Stateful | Yes — return traffic is automatically allowed |
| Rules | Allow rules ONLY (no Deny rules) |
| Default | Denies all inbound; allows all outbound |
| Evaluation | All rules evaluated before a decision |
| Association | Attached to instances; an instance can have multiple Security Groups |
Network ACLs (Subnet-Level Firewall)
A Network ACL is a firewall at the subnet level. All traffic entering or leaving the subnet is checked against its rules.
| Feature | Detail |
|---|---|
| Level | Subnet |
| Stateful | No — stateless; you must define inbound AND outbound rules |
| Rules | Both Allow AND Deny rules |
| Default | Default NACL allows all inbound and outbound traffic |
| Evaluation | Rules evaluated in number order (lowest first); first match wins |
| Association | One NACL per subnet; a NACL can be associated with multiple subnets |
Head-to-Head Comparison
| Feature | Security Group | Network ACL |
|---|---|---|
| Operates at | Instance level | Subnet level |
| Supports | Allow rules only | Allow AND Deny rules |
| Stateful? | Yes | No (stateless) |
| Rule evaluation | All rules evaluated | In number order, first match wins |
| Default behavior | Deny all inbound | Allow all (default NACL) |
On the Exam: Remember the pairing — Security Groups = stateful + instance level + Allow only; NACLs = stateless + subnet level + Allow AND Deny. Because Security Groups are stateful, allowing inbound traffic on a port automatically allows the response, regardless of outbound rules.
VPC Fundamentals
A Virtual Private Cloud (VPC) is a logically isolated virtual network in AWS where you launch resources.
| Component | Description |
|---|---|
| Subnets | Subdivisions of a VPC within an AZ (public or private) |
| Route Tables | Rules that determine where network traffic is directed |
| Internet Gateway (IGW) | Connects the VPC to the internet for public subnets |
| NAT Gateway | Lets private-subnet resources reach the internet outbound without being publicly reachable |
| VPC Peering | Private connection between two VPCs |
| VPC Endpoints | Private connection from a VPC to AWS services without using the internet |
Public vs. Private Subnets
| Subnet Type | Internet Access | Typical Use |
|---|---|---|
| Public | Direct, via Internet Gateway | Web servers, load balancers, bastion hosts |
| Private | Outbound only, via NAT Gateway | Databases, application servers, backends |
VPC Endpoints — Two Types
- Gateway Endpoint — used for Amazon S3 and DynamoDB; free; added as a route-table target
- Interface Endpoint (powered by AWS PrivateLink) — used for most other AWS services; provisions an elastic network interface with a private IP in your subnet
Encryption in Transit
Encryption in transit protects data as it moves between systems:
| Method | Description |
|---|---|
| SSL/TLS | Encrypts web traffic (HTTPS); used by most AWS services |
| VPN | Encrypted tunnel between on-premises and AWS |
| AWS PrivateLink | Private connectivity to AWS services without internet exposure |
| AWS Direct Connect + MACsec | Encrypted dedicated connection |
AWS Network Security Services
| Service | Purpose |
|---|---|
| AWS Network Firewall | Managed network firewall for filtering VPC traffic |
| AWS PrivateLink | Private connectivity between VPCs and services |
| AWS Direct Connect | Dedicated private network connection to AWS |
| AWS Site-to-Site VPN | Encrypted connection over the internet |
| AWS Transit Gateway | Connect many VPCs and on-premises networks through a central hub |
| Amazon Route 53 | DNS service that also supports DNS-based routing and health checks |
On the Exam: Match the need to the connection type — Direct Connect for a dedicated private link, VPN for an encrypted tunnel over the internet, PrivateLink/VPC Endpoints to reach AWS services without traversing the public internet, and Transit Gateway to interconnect many networks at scale.
Together, layered Security Groups and NACLs, well-designed public/private subnets, VPC endpoints, and encryption in transit implement the Well-Architected Security pillar principle of applying security at all layers (defense in depth).
Building Defense in Depth in a VPC
A typical secure architecture layers these controls. Place internet-facing load balancers in public subnets and application and database tiers in private subnets so backends are never directly reachable from the internet. Attach Security Groups to each tier to allow only the required ports (for example, the web tier accepts 443 from anywhere, while the database tier accepts 3306 only from the app tier's Security Group). Use a restrictive NACL as a coarse subnet-level backstop, a NAT Gateway for outbound patching from private subnets, and VPC endpoints to reach S3 or DynamoDB privately.
This layering is exactly the Well-Architected Security pillar's "apply security at all layers" principle in practice.
What is the key difference between Security Groups and Network ACLs?
A company wants resources in a private subnet to access the internet for software updates without being publicly accessible. What should they use?
By default, a new (custom) Security Group:
Which statement about Security Groups is correct?
A company needs to privately connect their VPC to Amazon S3 without traffic going over the internet. Which type of VPC endpoint should they use?
What is the purpose of AWS PrivateLink?