Flash card
Security groups versus network ACLs: instance-level stateful filtering against subnet-level stateless filtering.
- Security groups are stateful: allow a request in and the response goes out regardless of outbound rules. NACLs are stateless, so return traffic needs its own rule, typically on the ephemeral port range.
- Security groups attach to elastic network interfaces; NACLs attach to subnets and apply to everything in them.
- Security groups have allow rules only. NACLs have both allow and deny, which is what makes them able to block a specific address.
- NACL rules are evaluated in number order and the first match wins. Security group rules have no order; all are evaluated and any match permits.
- A security group can reference another security group as its source, which is how tiers are expressed without hardcoding addresses.
Pick it when
Pick a NACL when the requirement is to deny specific traffic, such as blocking one address range, because a security group cannot express a deny. Pick a security group for everything else, especially rules describing which tier may reach which.
It's the wrong answer when
A NACL is the wrong answer for per-instance rules, since it applies to the whole subnet. A security group is the wrong answer for blocking a known-bad address, and its statefulness makes a common distractor: any option adding an outbound rule so responses can return is describing a problem security groups do not have.