1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints

Quick Answer: Security groups are stateful firewalls at the instance/ENI level with Allow-only rules. Network ACLs (NACLs) are stateless firewalls at the subnet level supporting Allow and Deny. VPC endpoints connect to AWS services privately. Layer all three for defense in depth.

Security Groups (SGs)

A security group is a virtual firewall attached to an Elastic Network Interface (ENI) — on EC2, RDS, Lambda-in-VPC, and more.

Because SGs are stateful, an inbound rule for port 443 automatically permits the response — you never write a matching outbound rule. A powerful pattern is chaining by SG reference: the database SG allows port 3306 from the app-tier SG ID, not from an IP range, so scaling the app tier needs no firewall edits.

Network ACLs (NACLs)

A NACL is a stateless firewall at the subnet boundary.

Stateless means responses are not implied. If you allow inbound port 443, you must also allow outbound on ephemeral ports (1024–65535) so replies can leave, and vice versa.

On the Exam: "Block a single malicious IP from the whole subnet" → NACL Deny rule (security groups have no Deny). "Allow return traffic was blocked" → you forgot the ephemeral outbound NACL rule.

Side-by-Side

VPC Endpoints

VPC endpoints let resources reach AWS services privately, bypassing the internet gateway, NAT gateway, and VPN.

Benefits: traffic stays on the AWS backbone (security/compliance), you avoid NAT gateway data-processing charges (~$0.045/GB), and latency drops. Gateway endpoints attach to route tables and can be locked down with endpoint policies; interface endpoints carry a private IP and support security groups, and can be reached from on-premises over Direct Connect or VPN.

On the Exam: "Private subnet must reach S3 with no internet" → Gateway endpoint (free). "Private access to SQS / KMS / Secrets Manager" → Interface endpoint (PrivateLink).

VPC Flow Logs

VPC Flow Logs record IP-traffic metadata at the VPC, subnet, or ENI level.

Use them for connectivity troubleshooting (look for REJECT), anomaly detection, and compliance audits. Remember they log metadata only — they are not a packet capture; for payload inspection use Network Firewall or Traffic Mirroring.

Reading a Connectivity Failure (worked example)

The exam loves "my instance cannot be reached" scenarios that hinge on the SG-vs-NACL interaction. Walk the path in order. Suppose a web server in a public subnet is unreachable on port 443 from the internet. Check, in sequence: (1) the route table has a route to the internet gateway; (2) the NACL allows inbound 443 AND outbound on ephemeral ports 1024–65535 — a missing ephemeral outbound rule is the single most common NACL mistake; (3) the security group allows inbound 443 from the client range.

If inbound works but responses vanish, the culprit is almost always the stateless NACL missing the return-path rule, because the stateful security group would have handled the return automatically.

A second classic: instance A can ping instance B but B cannot reply. Because security groups are stateful, an allowed inbound flow returns freely, so a one-way failure between two instances usually means a NACL is blocking the ephemeral return ports on one subnet, not the security group.

Choosing the Right Private-Connectivity Tool

VPC endpoints are only one option for private access. Match the requirement to the mechanism:

Cost trap: Architects often default to a NAT gateway for S3 access in a private subnet. A Gateway endpoint removes that NAT data-processing cost entirely and keeps the traffic off the internet — frequently the "most cost-effective and secure" answer.

Defense in Depth Summary

Layered network security combines these controls so that no single misconfiguration is catastrophic: NACLs provide a coarse subnet-level Allow/Deny filter (good for blocking IPs), security groups enforce fine-grained stateful instance rules (the workhorse), endpoints keep AWS-service traffic private, and Flow Logs provide the audit trail to detect and investigate anything that slips through.