AWS Security Groups vs Network ACLs – SAP-C02 Study Guide | AWS Systems Architect Professional

Study guide

Technical reference and lesson notes

Purpose of This Lesson

Amazon VPC provides two important network firewall mechanisms: Security Groups and Network Access Control Lists (Network ACLs). Both can control traffic to workloads in a VPC, but they differ significantly in scope, statefulness, rule behavior, and supported actions.

Understanding these differences is essential for designing layered network security and selecting the correct control in SAP-C02 scenario questions.

Key Concepts

Stateful and Stateless Firewalls

When a client connects to a web server, the traffic includes:

Source IP address
Destination IP address
Source port
Destination port

For example, a client may connect to an HTTP server on destination port 80 using a dynamically assigned high-numbered source port, such as 65188.

The response reverses the communication details:

The server becomes the source
The client becomes the destination
The server’s port 80 becomes the response destination port on the client side
The client’s ephemeral port becomes the response source port

A stateful firewall understands that the response belongs to an established permitted connection. If the original traffic is allowed, the related return traffic is automatically allowed.

A stateless firewall evaluates each direction independently. A rule must permit the forward traffic, and another rule must permit the response traffic.

Security Groups

Security Groups are virtual firewalls associated with an instance’s Elastic Network Interface (ENI). They have these characteristics:

Operate at the instance or ENI level
Can be associated with instances in different subnets
Filter inbound and outbound traffic
Are stateful
Support allow rules only
Evaluate all applicable rules before deciding whether traffic is allowed
Can filter traffic between instances in the same subnet
Deny traffic by default unless an applicable allow rule exists

Because Security Groups are stateful, an allowed inbound connection does not require a separate outbound rule solely to permit its response traffic. The same principle applies to permitted outbound connections and their return traffic.

Security Groups are commonly used to express workload-level access requirements, such as allowing a web server to receive HTTP traffic or allowing a database to receive connections only from an application server’s Security Group.

Network ACLs

A Network Access Control List is associated with a subnet. It evaluates traffic entering or leaving that subnet:

Applies to ingress and egress traffic at the subnet boundary
Affects resources in the associated subnet
Is stateless
Supports both allow and deny rules
Processes rules in ascending rule-number order
Stops processing as soon as a matching rule allows or denies the traffic
Does not filter traffic that remains within the same subnet

Because Network ACLs are stateless, both directions of a connection must be explicitly permitted. For a client connecting to a web server, the Network ACL must allow the request to the server and the response traffic back to the client. This often requires accounting for the client’s ephemeral port range.

Rule Evaluation Differences

Security Groups and Network ACLs use fundamentally different decision models.

Characteristic	Security Group	Network ACL
Scope	Instance or ENI	Subnet
Traffic evaluated	Inbound and outbound traffic to associated ENIs	Traffic entering or leaving the subnet
Same-subnet instance traffic	Evaluated	Not evaluated at the subnet boundary
Stateful?	Yes	No
Supported rules	Allow only	Allow and deny
Rule processing	All applicable rules are evaluated	Rules evaluated in rule-number order
Processing behavior	Traffic is allowed if an applicable allow rule exists	First matching rule determines the result
Association model	Explicitly associated with an ENI or instance	Associated with a subnet

Exam-Relevant Takeaways

Security Groups are stateful; Network ACLs are stateless.
A Security Group automatically permits related return traffic when the original connection is allowed.
A Network ACL requires rules for both directions of traffic.
Security Groups support only allow rules. They cannot create an explicit deny rule.
Network ACLs support both allow and deny rules, making them useful for subnet-level blocking requirements.
Security Groups are attached to ENIs and can protect individual workloads across subnet boundaries.
A Network ACL applies broadly to traffic entering or leaving every resource in its associated subnet.
Network ACL rules are evaluated in ascending order, and the first matching rule ends evaluation.
Security Groups can control traffic between instances in the same subnet; Network ACLs do not inspect traffic that stays within the subnet.
When troubleshooting a stateless Network ACL, verify both the request path and the return path, including ephemeral ports.

Architecture Decision Guide

Requirement	Prefer	Reason
Restrict access to a specific EC2 instance or ENI	Security Group	Provides workload-level filtering
Allow a connection and automatically permit its response	Security Group	Stateful behavior tracks related traffic
Apply a common subnet boundary policy	Network ACL	Applies to traffic entering or leaving the subnet
Explicitly block a source or type of traffic	Network ACL	Supports deny rules
Control communication between instances in the same subnet	Security Group	Network ACLs do not evaluate same-subnet traffic
Enforce traffic rules in a deliberate priority order	Network ACL	Rule numbers determine evaluation order
Build layered defense	Both	Combine subnet-level and workload-level controls where appropriate

Common Exam Traps

Assuming Network ACLs are stateful: They are not. Return traffic needs a separate matching rule.
Assuming a Security Group can deny traffic: Security Groups only contain allow rules. Removing an allow rule or using another control is required to block traffic.
Confusing subnet scope with instance scope: A Network ACL applies to the subnet, while a Security Group applies to an ENI or instance.
Forgetting ephemeral ports: A Network ACL must permit the response traffic to the client’s dynamically assigned source port.
Treating Network ACL rules like Security Group rules: Network ACL evaluation stops at the first matching rule; later rules do not override that decision.
Expecting a Network ACL to protect same-subnet traffic: Traffic that remains within a subnet is not filtered by that subnet’s Network ACL.
Assuming one Security Group must belong to only one subnet: A Security Group can be associated with ENIs on instances in different subnets.

Real-World Engineer Notes

Use Security Groups to model application relationships, such as allowing an application tier to connect to a database tier without relying on fixed instance IP addresses.
Treat Network ACL changes carefully because they affect all applicable resources in a subnet, not just one workload.
When debugging connectivity through a Network ACL, inspect both directions and confirm that rule numbers do not cause an earlier rule to override the intended rule.
Security Groups and Network ACLs are complementary rather than interchangeable. A Security Group provides resource-level control, while a Network ACL provides a subnet boundary control.
Stateful behavior reduces the amount of response-path configuration required for Security Groups, but it does not eliminate the need to configure the correct inbound and outbound access policies.

Quick Reference Summary

Security Group: Stateful, instance/ENI-level, allow rules only, all rules evaluated.
Network ACL: Stateless, subnet-level, allow and deny rules, first matching rule wins.
Return traffic: Automatically handled by Security Groups; explicitly permitted by Network ACLs.
Same-subnet traffic: Filtered by Security Groups, not by Network ACLs.
Explicit denies: Available with Network ACLs, not Security Groups.

Flashcards

1. What is the primary scope of a Security Group?

An instance’s Elastic Network Interface. It provides workload-level filtering.

2. What is the primary scope of a Network ACL?

A subnet. It filters traffic entering or leaving that subnet.

3. Which control is stateful?

Security Groups are stateful. Related return traffic is automatically allowed when the original traffic is permitted.

4. Which control is stateless?

Network ACLs are stateless. Both directions of traffic must be explicitly allowed.

5. Can Security Groups contain deny rules?

No. Security Groups support allow rules only.

6. Can Network ACLs contain deny rules?

Yes. Network ACLs support both allow and deny rules.

7. How are Network ACL rules evaluated?

In ascending rule-number order. The first matching rule determines whether traffic is allowed or denied.

8. Do Network ACLs filter traffic between two instances in the same subnet?

No. They evaluate traffic entering or leaving the subnet, not traffic that remains within it.

9. Can one Security Group protect instances in different subnets?

Yes. Security Groups are associated with ENIs and can be used by instances across different subnets.

10. Why are ephemeral ports important with Network ACLs?

A client commonly uses a dynamically assigned high-numbered source port. The response traffic targets that port, so the Network ACL must permit the return path as well.

Practice Questions

Question 1

An application server in a private subnet connects to a database in the same VPC. The database’s Security Group allows inbound traffic from the application server’s Security Group on the database port. No corresponding outbound rule was added specifically for the response. What happens?

Correct answer: The response traffic is automatically permitted by the stateful Security Group behavior.

Explanation: Security Groups track connection state. Once the permitted connection is established, related return traffic is allowed automatically.

Question 2

A company wants to block traffic from a known source CIDR range at the subnet boundary while allowing other traffic. Which VPC control is most appropriate?

Correct answer: A Network ACL with an explicit deny rule for the source CIDR range.

Explanation: Network ACLs operate at the subnet level and support both allow and deny rules. Security Groups cannot express explicit deny rules.

Question 3

A Network ACL allows inbound HTTP traffic to a web server, but clients cannot complete the connection. The web server’s response traffic is being rejected. What is the most likely issue?

Correct answer: The Network ACL does not allow the return traffic to the client’s ephemeral port, or its outbound rules do not permit the response.

Explanation: Network ACLs are stateless. The request and response are evaluated independently, so both directions and the relevant ports must be allowed.

Question 4

An architect needs to restrict communication between two EC2 instances that are located in the same subnet. Which control should be used?

Correct answer: Security Groups associated with the instances’ ENIs.

Explanation: Security Groups operate at the instance/ENI level and can filter traffic between instances in the same subnet. The subnet’s Network ACL does not inspect traffic that remains within that subnet.

Question 5

A Network ACL contains these inbound rules:

Allow TCP traffic from 10.0.0.0/8
Deny TCP traffic from 10.1.0.0/16

A request arrives from 10.1.5.10. What is the result?

Correct answer: The request is allowed by rule 1.

Explanation: Network ACL rules are evaluated in rule-number order. The source matches rule 1, so processing stops before the later deny rule is evaluated. The deny rule would need a lower rule number than the broad allow rule to take precedence.