15.1 Network Security Automation: Security Groups, NACLs, Network Firewall & WAF

Network Security Defense-in-Depth Across the OSI Model

In modern cloud architectures, securing network ingress and egress requires a layered defense-in-depth model that spans multiple layers of the Open Systems Interconnection (OSI) framework. Rather than relying on a single perimeter firewall, AWS distributes network security controls across the edge, the Virtual Private Cloud (VPC) boundary, subnet perimeters, and individual Elastic Network Interfaces (ENIs).

OSI Layer Mapping of AWS Network Security Controls

---

Security Groups vs. Network ACLs: Architectural Comparison

DevOps engineers must master the behavioral differences between Security Groups and Network ACLs to ensure traffic flow reliability while enforcing strict least privilege.

Detailed Technical Comparison

Incoming Request (Client -> Web Server :443)
    │
    ▼
[ Subnet Boundary: Network ACL ] ──> Evaluates Inbound Rules (Rule 100: Allow TCP 443)
    │                                 (Stateless: must allow inbound port 443)
    ▼
[ Instance ENI: Security Group ]  ──> Evaluates Allow Rules (Allow TCP 443 from 0.0.0.0/0)
    │                                 (Stateful: opens connection tracking entry)
    ▼
[ Web Server Application ]
    │
    ▼ Response Sent (Web Server -> Client Ephemeral Port :49152)
[ Instance ENI: Security Group ]  ──> Auto-Permitted by Connection Tracking (Bypasses Outbound Rules)
    │
    ▼
[ Subnet Boundary: Network ACL ] ──> Evaluates Outbound Rules (Rule 100: Allow TCP 1024-65535)
                                      (Stateless: MUST have outbound ephemeral rule or packet drops!)

[!IMPORTANT] DOP-C02 Ephemeral Port Pitfall: When troubleshooting private subnet instances accessing external services (such as downloading patches via a NAT Gateway), the outbound connection initiates to port 80/443, but the return packets arrive on an ephemeral port. For Amazon Linux and NAT Gateways, the ephemeral range is 1024–65535. For Windows Server, it is 49152–65535. If the subnet NACL does not permit outbound ephemeral traffic, the response is dropped, resulting in client timeouts.

---

AWS WAF: Architecture, Rule Groups & Associations

AWS WAF is a Layer 7 web application firewall that inspects HTTP and HTTPS traffic targeting web endpoints. It operates using Web Access Control Lists (Web ACLs), which contain an ordered collection of rules evaluated by priority.

Supported Association Targets

• Amazon CloudFront: Distributed globally at edge locations. Web ACLs must be created in the us-east-1 (N. Virginia) region.
• Application Load Balancers (ALBs): Regional inspection before traffic hits backend EC2 targets or ECS containers.
• Amazon API Gateway: Regional inspection for REST and HTTP APIs.
• AWS AppSync: GraphQL API protection against oversized queries and nested introspection attacks.
• Amazon Cognito User Pools: Protection against credential stuffing and brute-force authentication attacks.

Rule Types and Evaluation Mechanics

1. AWS Managed Rules (AMR): Pre-configured, AWS-maintained rule sets:
   • Core Rule Set (CRS): Covers OWASP Top 10 vulnerabilities (XSS, path traversal, command injection).
   • Known Bad Inputs: Blocks malformed request patterns and known exploits.
   • SQL Database Rule Set: Detects SQL injection (SQLi) vectors.
   • Amazon IP Reputation List: Blocks IPs associated with bots, TOR nodes, and compromised hosts.
   • Bot Control: Classifies scrapers, search engines, and malicious automated tools.
   • Account Takeover Prevention (ATP): Protects login pages against credential stuffing.
2. Rate-Based Rules: Track request volume per originating IP address over a sliding evaluation window of 60, 120, 300 (default), or 600 seconds (1, 2, 5, or 10 minutes). If requests exceed the configured threshold (e.g., 300 requests per minute), WAF immediately applies the configured action (Block, Count, CAPTCHA, or Challenge) until the rate subsides.
3. Custom Rule Statements: Inspect headers, cookies, query arguments, HTTP methods, and body payloads using regex patterns, string matching, size constraints, and geo-matching (blocking or allowing by ISO country code).

{
  "Name": "RateLimitLoginEndpoint",
  "Priority": 10,
  "Action": {
    "Block": {}
  },
  "VisibilityConfig": {
    "SampledRequestsEnabled": true,
    "CloudWatchMetricsEnabled": true,
    "MetricName": "RateLimitLoginEndpoint"
  },
  "Statement": {
    "RateBasedStatement": {
      "Limit": 300,
      "EvaluationWindowSec": 60,
      "AggregateKeyType": "IP",
      "ScopeDownStatement": {
        "ByteMatchStatement": {
          "SearchString": "/api/v1/auth/login",
          "FieldToMatch": {
            "UriPath": {}
          },
          "TextTransformations": [
            {
              "Priority": 0,
              "Type": "LOWERCASE"
            }
          ],
          "PositionalConstraint": "EXACTLY"
        }
      }
    }
  }
}

---

Automated IP Blocking Pipelines

When standard rate limits or managed rules detect persistent malicious actors, organizations deploy automated pipelines to extract offending IP addresses and enforce dynamic blocklists across the infrastructure.

Sub-Minute Automated Remediation Workflow

1. Telemetry Streaming: AWS WAF full access logging is directed to an Amazon Kinesis Data Firehose delivery stream with a buffer interval set to 60 seconds (or directly to Amazon CloudWatch Logs / Amazon S3).
2. Log Parsing & Detection: Amazon Kinesis Data Firehose buffers incoming JSON log records and invokes an inline AWS Lambda transformation function or delivers logs to an S3 staging bucket where Amazon Athena or Lambda processes suspicious patterns (e.g., error codes 401/403 exceeding 50 per minute per IP).
3. Dynamic Rule Enforcement: Lambda calls the wafv2:UpdateIPSet API to insert the offending IP into an AWS WAF IP Set referenced by a high-priority block rule. Simultaneously, Lambda can invoke ec2:CreateNetworkAclEntry to block traffic at the subnet boundary before it consumes ALB compute resources.
4. Expiration Management: An Amazon DynamoDB table tracks the blocked IP address along with a Time to Live (TTL) attribute set to 1 hour. A DynamoDB Streams event or scheduled EventBridge rule triggers a cleanup Lambda function to remove expired IPs from the WAF IP Set.

---

AWS Network Firewall: Architecture & VPC Ingress Routing

While AWS WAF inspects Layer 7 HTTP/S applications, enterprise networks require deep packet inspection (DPI) for non-HTTP traffic, egress filtering to prevent data exfiltration, and stateful intrusion prevention (IPS).

Architectural Ingress Routing Pattern

AWS Network Firewall is deployed into a dedicated firewall subnet within each Availability Zone. Traffic routing is controlled using VPC Ingress Routing (edge route table associations attached to the Internet Gateway):

1. Edge Route Table: Associated with the Internet Gateway (IGW). Contains a route targeting the public workload subnet CIDR (10.0.1.0/24) with the target set to the Network Firewall VPC Endpoint (vpce-xxx).
2. Firewall Subnet Route Table: Contains a default route (0.0.0.0/0) pointing to the Internet Gateway (igw-xxx).
3. Workload Subnet Route Table: Contains a default route (0.0.0.0/0) pointing to the Network Firewall VPC Endpoint (vpce-xxx).

Internet
   │ (Ingress Traffic)
   ▼
[ Internet Gateway (IGW) ] ──> Edge Route Table: 10.0.1.0/24 -> vpce-firewall
   │
   ▼ (Redirected to Firewall)
[ Firewall Subnet: AWS Network Firewall Endpoint ] ──> Evaluates Suricata Rules & Domain Lists
   │                                                   (Allows legitimate traffic)
   ▼
[ Workload Subnet: Application Load Balancer / EC2 ]

Rule Group Engines

• Stateless Rule Groups: Evaluated first. Inspects 5-tuple packet attributes (source IP, source port, destination IP, destination port, protocol). Actions include Pass, Drop, or Forward to stateful rule groups.
• Stateful Rule Groups: Evaluates bidirectional connection state using Suricata-compatible syntax. Supports:
  • 5-tuple inspection with state tracking.
  • Domain list filtering: Allows or denies outbound HTTP Host and TLS SNI requests (e.g., preventing C2 exfiltration by allowing only *.corp.amazon.com).
  • Suricata IPS rules: Detects protocol anomalies, buffer overflows, and known malware signatures.

---

AWS Shield Standard vs. AWS Shield Advanced

Distributed Denial of Service (DDoS) attacks threaten service availability at Layers 3, 4, and 7. AWS provides two tiers of protection.

DDoS Protection Tier Comparison

For CloudFront and ALB resources, associate an AWS WAF v2 web ACL and use the current AWSManagedRulesAntiDDoSRuleSet for automated HTTP-flood detection and mitigation. Existing Shield Advanced customers may continue using the legacy Shield-managed Layer 7 Auto Mitigation feature, but AWS recommends the Anti-DDoS managed rule group. Health checks are a separate signal that improves detection and enables proactive SRT engagement; they do not by themselves turn on automatic Layer 7 mitigation.