AWS Security Groups v/s NACL

In today’s ever evolving tech world, it is very important to make your application safe and secure. In AWS there are two key components available to manage access to your AWS resources. Both protects your cloud infrastructure, works in different ways, suited for different scenarios. You will get to know more about these concepts further in the blog.

What are Security Groups?

Security Groups acts as a virtual firewall to our EC2 instances. Using SG you can control inbound and outbound traffic at instance level.

Inbound: Traffic that is coming into a system or network, such as requests from users or data being sent to a server.

Outbound: Traffic that is leaving a system or network, such as responses sent back to users or data being sent from a server to the internet.

Your can create Security Groups, specify rules to allow or deny traffic from particular IP range, ports.

Security Groups is a stateful component like if you allow inbound rules for particular port range, the outbound traffic will automatically allowed and vice versa.

Security Groups are associated at the Instance level.

What are Network Access Control Lists (NACLs)?

NACLs provide an additional layer of security at the subnet level within your VPC. They control traffic entering and leaving one or more subnets and uses rules that can allow or deny traffic.

NACLs is a stateless component as they do not automatically allow response traffic like if you allow incoming traffic for particular port then you have to allow outgoing traffic separately.

NACLs are associated at the Subnet level and affects all the resources in that subnet.

Key Differences Between Security Groups and NACLs

1. Level of Application:

   • Security Groups: Applied at the instance level.

   • NACLs: Applied at the subnet level.

2. Statefulness:

   • Security Groups: Stateful, automatically allowing return traffic.

   • NACLs: Stateless, requiring explicit rules for both inbound and outbound traffic.

3. Default Behavior:

   • Security Groups: Default allows no inbound traffic and allows all outbound traffic.

   • NACLs: Default allows all inbound and outbound traffic unless you specify otherwise.

4. Rule Evaluation:

   • Security Groups: Rules are evaluated based on the allowed traffic; if a rule allows traffic, it is permitted.

   • NACLs: Rules are evaluated in numerical order, and the first matching rule is applied.

This was all about Security Groups and NACLs in AWS.

Feel free to ask any related/non-related questions and give a like the blog.

Thank you for coming!!