Security Groups and Network ACLs
A VPC has two independent traffic controls. They are often described as interchangeable layers of the same thing; they are not, and the differences decide which one a given rule belongs in.
Security groups
Section titled “Security groups”A security group is a virtual firewall attached to a resource’s network interface — an EC2 instance, an RDS instance, a load balancer, a VPC endpoint. Multiple security groups can apply to one interface, and one security group can apply to many resources.
- Stateful. If a request is allowed out of an instance, the response is allowed back in regardless of the inbound rules, and responses to allowed inbound traffic are allowed out regardless of the outbound rules. Ephemeral ports never need to be opened.
- Allow rules only. A security group cannot express a deny. Anything not explicitly allowed is denied by default, and there is no way to carve an exception out of an allow rule. Use a network ACL when an explicit deny is required.
- Inbound rules specify a source: a CIDR block, a prefix list, or another security group — which is the idiomatic way to say “web tier may reach database tier” without hard-coding addresses.
- Outbound rules specify a destination in the same three forms. A new security group starts with no inbound rules and one outbound rule allowing all traffic.
- Protocols: TCP, UDP, ICMP and others by protocol number, with port ranges.
- Security groups do not filter traffic to and from the Amazon DNS resolver, DHCP, the EC2 instance metadata service, ECS task metadata endpoints, Windows licence activation or the Amazon Time Sync Service.
Network access control lists (NACLs)
Section titled “Network access control lists (NACLs)”A NACL applies to an entire subnet rather than to individual resources. Every subnet is associated with exactly one NACL; if none is specified, it inherits the VPC’s default NACL.
- Stateless. Return traffic is not implied. A rule that allows inbound traffic needs a matching rule in the opposite direction, which in practice means allowing the ephemeral port range — 1024–65535 covers all the common clients, though the exact range depends on the client’s operating system.
- Allow and deny. Each rule is explicitly ALLOW or DENY, which is what makes a NACL the place to block a specific address or port range.
- Ordered evaluation. Rules are numbered 1–32766 and evaluated from the lowest number upwards. The first match wins and evaluation stops. Number in increments of 10 or 100 so that rules can be inserted later.
- Defaults differ, and this catches people out. The default NACL that comes with a VPC
allows all inbound and outbound traffic. A NACL you create has only the unmodifiable
*rule at the end, which denies everything — so a custom NACL blocks all traffic until rules are added. - NACLs cannot block DNS requests to the Route 53 Resolver, and cannot block traffic to the instance metadata service. Use Route 53 Resolver DNS Firewall and the instance metadata options respectively.
Side by side
Section titled “Side by side”| Security group | Network ACL | |
|---|---|---|
| Applies to | A network interface | A subnet |
| State | Stateful | Stateless |
| Rule types | Allow only | Allow and deny |
| Evaluation | All rules evaluated; any allow permits | Lowest rule number first; first match wins |
| Sources | CIDR, prefix list, other security groups | CIDR only |
| Default for a newly created one | No inbound, allow all outbound | Deny all, inbound and outbound |
Using both
Section titled “Using both”Use both, and give each the job it is suited to.
- Express the intended connectivity in security groups, referencing other security groups rather than addresses. That is the layer that follows the workload.
- Use network ACLs for the coarse, subnet-wide statements: an explicit deny for a troublesome CIDR, or a blanket restriction on a subnet that should never talk to the internet.
- A NACL is a useful backstop for a misconfigured security group, because a resource launched into the subnet with the wrong group attached is still bounded by the subnet’s rules.
- Account for ephemeral ports whenever a NACL is anything other than allow-all, and remember that a deny rule on a load balancer’s subnet can silently break health checks.