Skip to content
PuglieseWeb Engineering HandbookSystemDox Pages

Network Security

AWS network protection is layered. A request from the internet passes several independent controls before it reaches an instance, and each control sees something the others do not.

  1. Edge. AWS Shield absorbs volumetric network and transport-layer attacks against CloudFront, Route 53, Global Accelerator and Elastic Load Balancing. AWS WAF inspects HTTP(S) requests at layer 7 and blocks web exploits and unwanted bots.
  2. VPC perimeter. AWS Network Firewall creates firewall endpoints in dedicated subnets inside the VPC; route tables steer traffic through them for stateful, Suricata-compatible inspection.
  3. Subnet. Network ACLs allow and deny traffic entering and leaving a subnet. They are stateless and evaluated in rule-number order.
  4. Resource. Security groups are stateful, contain allow rules only, and attach to individual network interfaces.
  5. DNS. Route 53 Resolver DNS Firewall filters outbound DNS queries by domain.
flowchart TB Internet((Internet)) --> Shield["AWS Shield<br/>layer 3/4 DDoS mitigation"] Shield --> WAF["AWS WAF<br/>layer 7 request inspection"] WAF --> ALB["Application Load Balancer<br/>API Gateway, CloudFront, AppSync"] ALB --> NFW["AWS Network Firewall<br/>endpoints in firewall subnets"] NFW --> NACL["Network ACL<br/>stateless, subnet level"] NACL --> SG["Security group<br/>stateful, allow-only, per interface"] SG --> EC2["Workload"] EC2 -.->|outbound DNS| DNSFW["Route 53 Resolver DNS Firewall"]

The order is not fixed — Network Firewall may sit ahead of the load balancer in a centralised inspection VPC, and not every design uses every layer — but the principle holds: each layer is independent, and a gap in one is not covered by the others.

Pages in this section

Section titled “Pages in this section”

Security groups and network ACLs draws the contrast that matters most day to day. AWS WAF, AWS Network Firewall, AWS Shield and AWS Firewall Manager each cover one service. DDoS and DDoS attacks and AWS protection strategies explain the attack mechanics the edge layer exists to absorb, and IDS and IPS covers detection and prevention systems alongside the AWS logging services.