AWS Security Groups and Network ACLs: Stateful and Stateless Traffic Control

Purpose of This Lesson

This lesson explains how to configure and troubleshoot Amazon EC2 security groups and VPC network access control lists (NACLs). The central assessment distinction is that security groups are stateful, while NACLs are stateless. The lesson also demonstrates outbound filtering, inbound web access, security group references, NACL rule ordering, and cleanup of lab resources.

Key Concepts

• Security groups are attached to network interfaces or EC2 instances and control allowed inbound and outbound traffic.
• Security groups are stateful: when traffic is allowed in one direction, the response traffic is automatically allowed, regardless of whether a separate reverse-direction rule exists.
• Security group rules are allow rules. A security group does not use the numbered first-match evaluation model shown by NACLs.
• Network ACLs are associated with subnets and evaluate inbound and outbound traffic separately.
• NACLs are stateless: an inbound allow does not automatically permit the response traffic. Both directions require appropriate rules.
• NACL rules are evaluated by ascending rule number. The first matching rule applies. The asterisk rule acts as the final catch-all if no numbered rule matches.
• Security groups can reference another security group as a source or destination. This supports tightly scoped communication between groups without permitting an entire IP range.
• NACL rules use IP addresses or CIDR ranges rather than security group references.
• A connection that simply hangs rather than immediately returning an error can indicate that traffic is being dropped by a security group or NACL.

EC2 and VPC Traffic-Control Workflow

1. Create a security group for management access

An example group named SG one was created in the default VPC with an inbound SSH rule. This permitted Instance Connect to establish an SSH session to an EC2 instance associated with that group.

The example initially removed the outbound security group rule. The SSH session still worked because the security group is stateful: the return traffic associated with the permitted inbound connection was allowed automatically.

2. Test explicitly initiated outbound traffic

A connection initiated by the instance is a different decision from response traffic:

• ping google.com required an outbound ICMP rule.
• curl http://google.com required an outbound HTTP rule.
• Restoring the typical outbound allow-all rule permitted both types of traffic.

This demonstrates an important diagnostic principle: statefulness permits response traffic for an allowed flow, but it does not mean every new outbound connection is automatically permitted when outbound rules are restricted.

3. Permit inbound web traffic

The instance was converted into a basic Apache web server by creating and running a shell script:

sudo nano user-data.sh
chmod +x user-data.sh
sudo ./user-data.sh

The script updated Linux patches and installed Apache. Although the web server was running, browsing to the instance’s public IP initially failed because the security group permitted SSH only. Adding an inbound HTTP rule allowed the browser request to reach Apache.

The resulting troubleshooting sequence was:

1. Confirm that the service is installed and running.
2. Confirm that the instance has a reachable public IP path.
3. Check whether the security group allows the service port, such as TCP 80 for HTTP.
4. Check the subnet’s NACL if the security group appears correct.

4. Restrict instance-to-instance traffic with security group chaining

A second instance was launched with SG two, initially without inbound rules. An ICMP test from the first instance failed because the second instance had no matching inbound rule.

Instead of allowing ICMP from the entire internet, an inbound ICMP rule was added to SG two with SG one as the source. This allowed traffic from resources associated with SG one while avoiding a broad public IP-based rule.

This pattern is commonly called security group chaining or referencing one security group from another. The same general approach can be used for outbound destinations when the traffic policy requires communication only between selected groups.

Network ACL Rule Evaluation and Statefulness

The default NACL allowed all traffic with a low-numbered rule. Adding a deny-all rule with number 101 did not block traffic because the earlier allow rule matched first. Changing the deny rule to number 99 caused it to be evaluated before the allow rule, so the deny took effect.

The practical model is:

1. Evaluate rule 1, then rule 2, and so on in ascending order.
2. Stop at the first matching rule.
3. If no numbered rule matches, evaluate the asterisk catch-all behavior.
4. Apply the decision independently to inbound or outbound traffic.

For example, a rule denying a specific public IP can use a /32 CIDR, which represents one IPv4 address. Broader CIDR ranges can be used when an entire network range should be matched.

Because NACLs are stateless, a rule allowing inbound traffic does not automatically allow the response path. The corresponding outbound traffic must also be allowed. This remains true even when the outbound packets are responses to an inbound connection.

Exam- or Assessment-Relevant Takeaways

For AWS Certified CloudOps Engineer Associate scenario questions, identify the traffic-control layer and the requested behavior before selecting a solution:

• Choose a security group for instance-level allow rules and stateful behavior.
• Choose a NACL when subnet-level filtering and explicit independent control of both directions are required.
• If an inbound security group rule permits a connection, do not add a reverse security group rule solely for response traffic; stateful behavior handles it.
• If a NACL allows inbound traffic, verify the outbound response path separately.
• For a NACL deny rule to override an allow rule, it must have a lower rule number and therefore be evaluated first.
• Use a security group reference when one application tier should communicate with another group, rather than exposing the source to an entire IP range.
• Use IP or CIDR matching in a NACL; NACL rules do not use security group sources.
• A restricted outbound security group can block newly initiated ICMP or HTTP connections even when inbound management access still works.
• When a browser or SSH client hangs, investigate filtering rules as well as service availability. A dropped packet may not produce an immediate application error.

Tool / Feature Decision Guide

Requirement	Prefer	Decisive reason
Allow SSH to a particular EC2 instance or interface	Security group	Instance-level, stateful allow control is appropriate.
Permit HTTP to a web server	Security group inbound TCP 80, with any required subnet filtering also permitted	The web request must be explicitly allowed to reach the instance.
Restrict outbound ICMP or HTTP initiated by an instance	Security group outbound rules	Newly initiated flows require an outbound match when egress is restricted.
Allow one application group to reach another	Security group reference	The source can be limited to members of a specific security group instead of an internet CIDR.
Apply filtering across a subnet	NACL	NACLs are associated with subnets and evaluate traffic independently in each direction.
Block one known IPv4 address	NACL rule using a /32 source or destination	NACL matching uses IP addresses and CIDR ranges.
Make a deny override an existing NACL allow	Lower-numbered deny rule	NACL evaluation stops at the first matching rule.
Allow a connection and its return traffic with minimal reverse-rule configuration	Security group	Security groups are stateful.

Common Traps / Misconceptions

• “A security group with no outbound rule cannot return SSH traffic.” Security groups are stateful, so response traffic for an allowed inbound connection is permitted automatically. However, a newly initiated outbound connection still needs an outbound rule when egress is restricted.
• “Adding a deny rule to a NACL always blocks traffic.” It only blocks traffic if it is the first matching rule. A higher-numbered deny can be bypassed by an earlier allow.
• “NACLs are stateful like security groups.” They are stateless; inbound and outbound decisions are separate.
• “A NACL can use a security group as its source.” NACL rules use IP addresses and CIDR ranges. Security group references apply to security group rules.
• “A running Apache server proves that port 80 is reachable.” The service may be healthy while the security group or NACL drops the request.
• “A connection hang proves the service is stopped.” Filtering can cause the same symptom. Check network policy before concluding that the application is unavailable.
• “The default NACL deny rule will override all earlier allows.” The asterisk is a final catch-all; an earlier matching rule wins.

Real-World Engineer / Analyst Notes

• Start troubleshooting with the traffic path: source, destination, protocol, port, direction, instance security group, subnet NACL, and service status.
• Test one protocol at a time. ICMP reachability does not prove that HTTP is permitted, and HTTP reachability does not prove SSH access.
• Keep management access, application access, and inter-tier access conceptually separate. This makes rules easier to review and reduces unnecessarily broad permissions.
• Prefer a security group reference for stable application-tier relationships when the design calls for communication between selected groups.
• Be cautious when modifying a shared or default NACL. A low-numbered deny can affect every subnet associated with that ACL, including management access and existing web traffic.
• Clean up lab instances and other temporary resources after testing. The demonstrated cleanup step was to terminate both EC2 instances.

Quick Reference Summary

• Security group: instance or network-interface level, stateful, allow-oriented.
• NACL: subnet level, stateless, ordered numbered rules with first-match processing.
• Security group response traffic: automatically allowed for an accepted flow.
• NACL response traffic: requires a separate rule in the opposite direction.
• Security group chaining: reference SG one from SG two to restrict traffic to members of the source group.
• NACL source and destination matching: IP addresses and CIDR ranges, including /32 for one IPv4 address.
• NACL ordering: lower numbers are evaluated first; the first match controls the result.
• Common tests: SSH for management, ICMP for ping, and HTTP for web access.
• Common symptom: a hanging connection may indicate dropped network traffic.

Flashcards

Q: An EC2 instance permits inbound SSH, but its outbound security group rule has been removed. Why can an existing SSH session still work?

A: Security groups are stateful, so response traffic for the permitted inbound SSH flow is automatically allowed. This does not automatically permit unrelated outbound connections initiated by the instance.

Q: Which control should you use to allow only instances in SG one to send ICMP traffic to instances in SG two?

A: Add an inbound ICMP rule to SG two whose source is SG one. This avoids allowing ICMP from every IP address on the internet.

Q: When would you use a NACL instead of relying only on security groups?

A: Use a NACL when subnet-level filtering or explicit, independent control of inbound and outbound traffic is required. Remember that NACLs are stateless.

Q: A NACL has an allow-all rule numbered 100 and a deny-all rule numbered 101. What happens?

A: The allow-all rule matches first, so the deny rule is not reached. Changing the deny rule to a lower number, such as 99, makes it effective.

Q: What is the effect of the asterisk rule in a NACL?

A: It acts as the final catch-all after the numbered rules. Earlier matching numbered rules take precedence.

Q: An instance can ping google.com but cannot run curl http://google.com after outbound rules were restricted. Which rule is missing?

A: An outbound HTTP rule is missing. ICMP permission does not authorize HTTP traffic.

Q: An Apache server is running, but a browser request to the instance’s public IP hangs. What should you check first at the security-group layer?

A: Check for an inbound HTTP rule, typically permitting TCP port 80 from the intended source. A running service does not bypass network filtering.

Q: How do security group rules differ from NACL rules in their source matching?

A: Security groups can reference another security group, while NACL rules use IP addresses or CIDR ranges. NACLs cannot use a security group as a source.

Q: Why must a NACL allow both inbound and outbound traffic for a successful connection?

A: NACLs are stateless and evaluate each direction independently. The response path must have its own matching outbound or inbound rule.

Q: What does a /32 CIDR represent in an IPv4 NACL rule?

A: It represents one individual IPv4 address because all 32 address bits are fixed by the mask.

Q: A ping from Instance 1 to Instance 2 fails, and Instance 1 has outbound ICMP allowed. What other policy should you inspect?

A: Inspect Instance 2’s inbound security group rules and the relevant subnet NACL rules. The destination must allow the incoming ICMP traffic, and the NACL must allow both directions.

Q: What is the main operational difference between a security group and a NACL during rule evaluation?

A: Security groups provide stateful allow rules without the NACL-style numbered first-match sequence. NACLs process numbered rules in ascending order and are stateless.

Q: Why can a security group reference be more restrictive than an internet-wide IP rule for inter-instance traffic?

A: It limits the source to resources associated with a selected security group rather than permitting any matching public or private IP address in a broad range.

Practice Questions

Question 1

An EC2 instance can be reached through Instance Connect, but ping google.com fails after the administrator removed the security group’s outbound allow-all rule. What is the best explanation?

A. Security groups always block response traffic unless outbound SSH is allowed.

B. ICMP must be explicitly allowed for the newly initiated outbound ping.

C. NACLs cannot allow traffic to public IP addresses.

D. Instance Connect disables outbound traffic after login.

Correct answer: B

The decisive clue is that the instance is initiating a new ICMP connection. A restricted outbound security group needs an outbound ICMP rule; statefulness only handles response traffic for an allowed flow.

Question 2

A subnet NACL contains an allow-all rule numbered 100. An administrator adds a deny-all rule numbered 101, but the web server remains reachable. What change will make the deny effective?

A. Change the rule protocol from all traffic to HTTP.

B. Associate the NACL with a security group.

C. Change the deny rule to a number lower than 100.

D. Add the deny rule only to the outbound rule set.

Correct answer: C

NACLs evaluate rules from the lowest number upward and stop at the first match. A deny rule numbered 99 will be evaluated before the allow-all rule numbered 100.

Question 3

A team wants only application instances associated with SG one to send ICMP traffic to a test instance associated with SG two. Which configuration best meets the requirement?

A. Add an inbound ICMP rule to SG two from 0.0.0.0/0.

B. Add an inbound ICMP rule to SG two with SG one as the source.

C. Add a NACL rule with SG one as the source.

D. Remove all outbound rules from SG one.

Correct answer: B

A security group can reference another security group as the source. This restricts the traffic to members of SG one instead of exposing ICMP to every IP address.

Question 4

An inbound NACL rule allows HTTP to a web server, but clients cannot complete the connection. The outbound NACL rule set does not allow the response traffic. What is the likely cause?

A. NACLs automatically allow response traffic, so the issue must be Apache.

B. Security groups cannot allow HTTP when NACLs are enabled.

C. The NACL is stateless, so the outbound response must be explicitly permitted.

D. HTTP requires an ICMP outbound rule instead of an HTTP rule.

Correct answer: C

NACLs evaluate each direction independently. The inbound HTTP allow does not create an automatic outbound allowance for the server’s response.

Question 5

A web server is running Apache, but a request to its public IP hangs. SSH works from the administrator’s client. Which next step is most appropriate?

A. Add an inbound HTTP rule to the instance’s security group.

B. Replace the security group with a NACL reference.

C. Add an outbound SSH rule only.

D. Change the NACL deny rule to a higher number without checking existing rules.

Correct answer: A

SSH working confirms that the management path is allowed, but it does not permit HTTP. The security group needs an inbound rule for the web service, such as TCP port 80 from the intended source.

WordPress Metadata

Suggested Slug:
aws-security-groups-network-acls-stateful-stateless

Meta Description:
Study how AWS security groups and network ACLs control traffic, including statefulness, rule evaluation order, security group references, and troubleshooting techniques.

Tags:
AWS, AWS Certified CloudOps Engineer, EC2, VPC, Security Groups, Network ACLs, Stateful Firewall, Stateless Firewall, AWS Networking, Cloud Security