AWS Certified Solutions Architect – Associate
Security groups vs network ACLs: stateful vs stateless
A security group works at the instance level, has allow rules only, evaluates every rule, and is stateful, so responses are allowed automatically. A network ACL works at the subnet level, has allow and deny rules that are evaluated in number order, and is stateless, so responses need a rule of their own.
The four differences
Level: a security group applies to the resources associated with it, such as an EC2 instance. A network ACL applies to every instance in the subnets associated with it.
Rule type: a security group has allow rules only. A network ACL has allow and deny rules. If you need to block one address range, only the network ACL can do it.
Evaluation: a security group evaluates all its rules before deciding. A network ACL evaluates rules in ascending order and stops at the first match.
Return traffic: a security group is stateful. If it allows a request in, the response is allowed out regardless of the outbound rules. A network ACL is stateless. Allowing a request in does not allow the response out.
AWS recommends security groups as the primary control. Use network ACLs as a secondary control, for example to deny a specific subset of traffic, or as a subnet guard rail in case an instance is launched without the correct security group. Security group rules can also reference another security group as the source, which network ACL rules cannot.
Network ACL rule order and defaults
Each network ACL rule has a number from 1 to 32766. AWS evaluates the lowest number first. When traffic matches a rule, that rule is applied and no later rule is checked. A deny numbered 90 beats an allow numbered 100 for the same traffic. AWS recommends numbering in steps of 10 or 100 so you can insert rules later.
Every network ACL ends with a rule numbered * that denies anything not matched by an earlier rule. You cannot delete it. A custom network ACL therefore denies all traffic until you add allow rules.
Every subnet must be associated with a network ACL. A subnet without an explicit association uses the VPC's default network ACL. One network ACL can serve many subnets, but a subnet has only one network ACL at a time. Rules are checked when traffic enters or leaves the subnet, not for traffic routed inside the subnet.
Return traffic and ephemeral ports
A response goes back to the client's source port, which the client picks from its ephemeral range. Many Linux kernels use 32768-61000. Windows Server 2008 and later use 49152-65535. Elastic Load Balancing, NAT gateways and AWS Lambda use 1024-65535.
A web server in your subnet that receives HTTPS from Windows clients therefore needs an outbound network ACL rule to ports 49152-65535. Allowing outbound 443 alone lets no response leave. When an instance in your subnet is the client, the network ACL needs an inbound rule for the instance's own ephemeral range.
To cover many client types, AWS suggests opening 1024-65535. Put any deny rules for specific ports in that range earlier in the table than the wide allow.
Traffic neither one filters
Security groups and network ACLs do not filter traffic to and from Amazon DNS, Amazon DHCP, EC2 instance metadata, ECS task metadata endpoints, Windows license activation, the Amazon Time Sync Service, and the reserved addresses of the default VPC router.
To block DNS lookups through the Route 53 Resolver, use Route 53 Resolver DNS Firewall. To control access to the Instance Metadata Service, use the instance metadata options on the instance.
Where the exam catches people
- Believing a security group can block one address range: security groups have allow rules only, so the block goes in a network ACL deny rule.
- Believing a network ACL deny always beats an allow: rules run from the lowest number up and the first match wins, so a lower-numbered allow wins.
- Believing an inbound allow in a network ACL lets the response out: network ACLs are stateless, so the response to the client's ephemeral port needs an outbound rule.
- Believing a security group needs outbound rules for responses: security groups are stateful, so responses to allowed inbound traffic leave regardless of outbound rules.
- Believing a network ACL can stop DNS lookups through the Route 53 Resolver: it cannot, and Route 53 Resolver DNS Firewall is the tool for that.