Purpose of This Lesson

This lesson explains how AWS Security Groups and Network Access Control Lists (NACLs) protect resources inside an Amazon VPC. The key study goals are to distinguish their scope, understand stateful versus stateless behavior, and select the appropriate control when analyzing inbound and outbound traffic.

Key Concepts

• Security Group: A stateful firewall associated with an instance through its Elastic Network Interface (ENI). It supports allow rules only.
• Network ACL: A stateless firewall applied at the subnet level. It evaluates traffic entering and leaving the subnet and supports both allow and deny rules.
• Stateful filtering: Return traffic for an allowed connection is automatically permitted.
• Stateless filtering: Forward and return traffic are treated as separate flows, so rules are required in both directions.
• Ingress: Traffic entering a resource or subnet.
• Egress: Traffic leaving a resource or subnet.
• Ephemeral source port: A dynamically assigned, high-numbered client port used for the outbound side of a connection.

Traffic Flow and Stateful vs. Stateless Filtering

A network connection includes a source IP address, destination IP address, source port, and destination port. For a client connecting to an HTTP web server, the request might use:

• Client source port: a dynamically assigned high-numbered port, such as 65188
• Web server destination port: 80, the well-known port for unsecured HTTP

The response reverses the port roles: the web server sends from port 80 to the client’s ephemeral port. Although these are opposite-direction flows, they belong to the same connection.

A stateful firewall tracks this relationship. If the initial traffic is permitted, the corresponding return traffic is automatically allowed. A stateless firewall does not associate the two flows, so the request and response each require an appropriate rule.

Security Group Behavior

Security Groups:

• Operate at the instance level, technically through the instance’s attached ENI.
• Can be associated with instances in different subnets.
• Filter traffic to and from associated instances, including traffic between instances in the same subnet.
• Are stateful, so permitted return traffic is automatically allowed.
• Support allow rules only; traffic is denied unless an applicable allow rule permits it.
• Evaluate the rules to determine whether the specific traffic is allowed rather than processing rules as a first-match numbered sequence.

Network ACL Behavior

Network ACLs:

• Operate at the subnet level.
• Apply to traffic entering or leaving the associated subnet.
• Affect instances in that subnet.
• Do not filter traffic that remains within the same subnet between instances.
• Are stateless, so inbound and outbound rules must be configured independently.
• Support both allow and deny rules.
• Process rules in numbered order and stop when a rule allows or denies the traffic. Rules appearing later are not evaluated after a match.

Exam- or Assessment-Relevant Takeaways

For SOA-C03-style scenario analysis, identify the filtering boundary and the required rule behavior before choosing a control:

1. Instance-level requirement: Choose the Security Group concept when the question focuses on a particular instance or ENI.
2. Subnet-level requirement: Choose the NACL concept when the control must apply at the subnet boundary.
3. Return traffic: A Security Group automatically permits response traffic for an allowed connection; a NACL requires the corresponding reverse-direction rule.
4. Explicit blocking: A NACL can express deny rules. Security Groups provide allow rules only.
5. Same-subnet traffic: Security Groups can filter traffic between instances in the same subnet; NACLs do not see traffic that stays inside the subnet.
6. Rule processing: NACL rule numbers matter because evaluation stops at the first matching allow or deny rule. Security Group rules are evaluated to determine whether an applicable allow exists.

These distinctions are useful for assessment scenarios, but they should be applied as technical reasoning rather than memorized as isolated definitions.

Tool / Feature Decision Guide

Requirement or clue	Security Group	Network ACL
Apply filtering to a specific instance or its ENI	Yes	No; applies to the subnet
Apply a boundary to traffic entering or leaving a subnet	No	Yes
Filter traffic between instances in the same subnet	Yes	No
Automatically allow related return traffic	Yes; stateful	No; stateless
Configure explicit deny rules	No	Yes
Use both allow and deny rules	No	Yes
Rely on numbered first-match processing	No	Yes

Use the Security Group as the primary concept when the requirement is resource-specific and connection-aware. Use a NACL when the requirement is subnet-wide filtering, explicit deny behavior, or independent control of ingress and egress flows.

Common Traps / Misconceptions

• Confusing subnet scope with instance scope: A NACL is associated with a subnet, while a Security Group is associated with an instance through its ENI.
• Assuming NACLs filter all traffic in a subnet: They apply to traffic entering or leaving the subnet, not traffic that remains within it.
• Forgetting ephemeral ports: A client response does not necessarily return to a well-known server port. It returns to the client’s dynamically assigned source port.
• Treating both controls as stateful: Security Groups are stateful; NACLs are stateless.
• Looking for deny rules in Security Groups: Security Groups support allow rules only. NACLs support both allow and deny rules.
• Ignoring NACL rule order: Once a numbered NACL rule matches, evaluation stops. A later rule cannot override that decision.
• Assuming an inbound rule is enough for a NACL: Because NACLs are stateless, the reverse traffic direction needs its own rule.

Real-World Engineer / Analyst Notes

When troubleshooting connectivity, map the complete flow rather than checking only the destination port. Record the source and destination IP addresses, both ports, and the direction of each flow. Then ask:

1. Does the traffic cross a subnet boundary, or does it remain within one subnet?
2. Which instance ENI Security Groups apply?
3. Which subnet NACL applies to the inbound and outbound paths?
4. If a NACL is involved, which numbered rule matches first in each direction?
5. If the connection was allowed in one direction, has the reverse direction also been permitted at the stateless boundary?

This approach prevents a common diagnostic error: confirming that the server’s listening port is allowed while overlooking the dynamically assigned client port and the return path.

Quick Reference Summary

• Security Groups: Instance/ENI level, stateful, allow rules only, filter same-subnet instance traffic, and automatically allow related return traffic.
• Network ACLs: Subnet level, stateless, allow and deny rules, filter traffic entering or leaving the subnet, and do not filter traffic that stays within the subnet.
• Stateful: An allowed flow’s related response is automatically permitted.
• Stateless: Request and response require independent rules.
• NACL processing: Rules are evaluated in numbered order and stop at the first match.
• HTTP example: A client uses a dynamic high-numbered source port to reach server port 80; the response returns from port 80 to that client source port.

Flashcards

Q: A web client connects to a server on TCP port 80 using ephemeral source port 65188. What port does the server use as the destination port in its response?

A: The response is sent to the client’s ephemeral port, 65188; the server sends from source port 80.

Q: Which AWS control should you associate with a specific EC2 instance’s network interface, and what is its state behavior?

A: Use a Security Group. It is associated with the instance’s ENI and is stateful, so related return traffic is automatically allowed.

Q: When would a NACL be more appropriate than a Security Group based on scope?

A: Use a NACL when filtering must apply at the subnet boundary to traffic entering or leaving the subnet rather than to one specific instance.

Q: An instance sends an allowed request through a Security Group. Must a separate rule allow the related response?

A: No. Security Groups are stateful and automatically allow related return traffic for an allowed connection.

Q: Why must a NACL have rules for both directions of a connection?

A: NACLs are stateless. The request and response are treated as separate flows, so inbound and outbound traffic must each be permitted.

Q: Which control can explicitly deny traffic: a Security Group, a NACL, or both?

A: A NACL can explicitly allow or deny traffic. Security Groups support allow rules only.

Q: Two instances communicate while remaining in the same subnet. Which control can filter that traffic?

A: Security Groups can filter it because they operate at the instance level. The NACL does not see traffic that stays within the subnet.

Q: How does NACL rule ordering affect a traffic decision?

A: NACL rules are evaluated in numbered order, and processing stops at the first matching allow or deny rule. Later rules are ignored for that traffic.

Q: Can one Security Group be associated with instances in different subnets?

A: Yes. Security Groups are attached to instance ENIs and can be applied to instances across different subnets.

Q: What is the key difference between Security Group rule evaluation and NACL rule evaluation?

A: Security Groups evaluate their rules to determine whether an applicable allow exists. NACLs evaluate numbered rules sequentially and stop at the first match.

Q: A NACL allows inbound traffic to a web server, but the response is blocked. What is the likely configuration issue?

A: The outbound NACL rules may not allow the response flow. Because the NACL is stateless, the reverse direction requires its own permitted rule, including the relevant client ephemeral port.

Q: What traffic does a NACL not filter?

A: It does not filter traffic that remains within the same subnet between instances. It filters traffic entering or leaving the associated subnet.

Practice Questions

Question 1

An operations team needs a control that blocks traffic from a particular source using an explicit deny rule at the subnet boundary. Which option best fits the requirement?

A. A Security Group attached to one instance
B. A Network ACL associated with the subnet
C. A Security Group applied to every instance in the VPC
D. A stateful firewall rule on the client

Correct answer: B. A NACL operates at the subnet level and supports explicit deny rules. Security Groups support allow rules only.

Question 2

A client connects to an EC2 web server on port 80. The inbound request is permitted by the server’s Security Group, but no outbound rule specifically names the client’s ephemeral port. What should be expected?

A. The response is automatically allowed by the stateful Security Group
B. The response is blocked because Security Groups are stateless
C. The response is evaluated only by the subnet’s NACL
D. The response must use port 80 as its destination port

Correct answer: A. Security Groups are stateful, so related return traffic is automatically allowed after the inbound connection is permitted.

Question 3

Two EC2 instances in the same subnet cannot communicate. The engineer wants a control capable of filtering that traffic at the resource level. Which control should be examined first?

A. The subnet’s NACL
B. The instances’ Security Groups
C. Only the route table for the subnet
D. A NACL on a different subnet

Correct answer: B. Security Groups operate at the instance/ENI level and can filter traffic between instances in the same subnet. NACLs do not filter traffic that stays within the subnet.

Question 4

A subnet NACL has a low-numbered rule that denies a source CIDR, followed by a higher-numbered rule that allows the same source. What is the result for matching traffic?

A. The allow rule overrides the deny because it appears later
B. Both rules are combined and the more permissive result is used
C. The first matching deny rule stops evaluation and the traffic is denied
D. NACLs cannot contain both allow and deny rules

Correct answer: C. NACL rules are evaluated in numbered order, and processing stops at the first matching rule.

Question 5

A security design must apply independently configured controls to traffic entering and leaving a subnet. The team also needs explicit deny capability. Which option is the best match?

A. A stateful Security Group
B. A stateless NACL
C. A Security Group with a deny rule
D. A Security Group that ignores return traffic

Correct answer: B. NACLs are stateless, require separate directional rules, and support both allow and deny rules.

WordPress Metadata

Suggested Slug:
aws-security-groups-network-acls-stateful-stateless-filtering

Meta Description:
Understand how AWS Security Groups and Network ACLs differ in scope, rule behavior, state tracking, and traffic-filtering decisions within a VPC.

Tags:
AWS, AWS VPC, Security Groups, Network ACLs, EC2, Network Security, Stateful Firewall, Stateless Firewall, AWS Certified CloudOps Engineer, SOA-C03