AWS Security Groups and NACL: A Simple Guide to AWS Network Security

AWS Security Groups and NACL: A Simple Guide to AWS Network Security

When we build an AWS network, creating a VPC, subnets, route tables, Internet Gateway, and NAT Gateway is only one part of the architecture.

We also need to answer an important question:

Who is allowed to access our resources, and what traffic should be allowed or blocked?

This is where two important AWS networking components come into the picture:

  • Security Groups
  • Network Access Control Lists (NACLs)

Both control network traffic, but they work differently.

In this article, let’s understand them with a simple example and follow how traffic moves through a VPC.

1. Our AWS Network

Let’s start with the network from the previous architecture.

We have:

AWS Region
│
└── VPC
    │
    │ 192.168.0.0/23
    │
    ├── Availability Zone 1a
    │     │
    │     └── Public Subnet
    │
    └── Availability Zone 1b
          │
          └── Private Subnet
                │
                └── EC2

The uploaded notes use a VPC with CIDR 192.168.0.0/23, with a public subnet 192.168.0.0/25 and a private subnet 192.168.0.128/25. The diagram also shows separate public/private route tables, NAT, and NACLs.

Now we need to secure this network.

2. What Is a Security Group?

A Security Group acts like a firewall for AWS resources such as:

  • EC2
  • RDS
  • Application Load Balancer

Think of it like a security guard standing outside a particular building.

For example:

Internet
   ↓
Security Group
   ↓
EC2

The Security Group decides whether traffic can reach the resource.

The notes describe Security Groups as applying inbound and outbound rules to resources such as EC2, RDS and ALB.

3. Security Groups Are Stateful

This is one of the most important concepts.

Security Groups are stateful.

What does that mean?

Suppose an EC2 instance makes an HTTPS request to Google:

EC2
 │
 │ HTTPS request
 ↓
Google

If the outbound traffic is allowed, the response can come back:

Google
 │
 │ Response
 ↓
EC2

You don’t need to create a separate inbound rule just for the response traffic.

The notes explain this using the example:

EC2 → Google
Google → EC2

When the outbound connection is allowed, the response is automatically allowed as part of the established connection.

4. Security Group Inbound and Outbound Rules

A Security Group has two main types of rules:

Inbound rules

Control incoming traffic.

For example:

Internet
   ↓
Inbound Rule
   ↓
EC2

Outbound rules

Control traffic leaving the resource.

For example:

EC2
   ↓
Outbound Rule
   ↓
Internet

In the example from the notes, the Security Group has no inbound rule and allows outbound HTTPS traffic on port 443.

5. Example Security Group

Suppose we create a Security Group called:

private-sg-ec2

We attach it to our VPC.

We can configure:

Inbound

No rules

Meaning:

Internet → EC2

is not allowed through this Security Group.

Outbound

HTTPS
TCP
Port 443
Destination: 0.0.0.0/0

Meaning:

EC2 → Internet

is allowed over HTTPS.

The notes demonstrate this configuration in the AWS console.

6. Selecting the Security Group During EC2 Creation

When creating an EC2 instance, we can select the VPC and then select an existing Security Group.

The workflow shown in the notes is:

EC2
 ↓
Launch Instance
 ↓
Network Settings
 ↓
Select VPC
 ↓
Select existing Security Group

The screenshot on page 6 shows an EC2 instance being configured with the previously created Security Group.

7. What Is a NACL?

NACL stands for:

Network Access Control List

A NACL works at the subnet level.

Think of it as a security guard standing outside an entire building complex.

For example:

                 NACL
                  ↓
              Subnet
           ┌──────┴──────┐
           │             │
          EC2           EC2

The NACL controls traffic entering and leaving the subnet.

The notes describe NACL rules as being applied at the subnet level.

8. NACLs Are Stateless

This is the biggest difference between a NACL and a Security Group.

NACLs are stateless.

That means AWS does not automatically remember that an incoming request was allowed when evaluating the response.

You must configure the appropriate inbound and outbound rules separately.

For example:

Request:

Internet
   ↓
NACL
   ↓
EC2

You may need rules allowing the request.

For the response:

EC2
   ↓
NACL
   ↓
Internet

you also need the appropriate outbound rule.

The notes explicitly describe NACLs as stateless and state that inbound and outbound rules must be configured separately.

9. NACL Supports Allow and Deny

Another important difference:

NACLs support both:

ALLOW
DENY

For example:

Rule 100 → ALLOW
Rule 200 → DENY

This gives us more explicit control over traffic at the subnet level.

The notes specifically mention that NACLs support both Allow and Deny rules.

10. NACL Rule Numbers

NACL rules have rule numbers.

For example:

Rule 100
Rule 200
Rule 300

The lower rule number gets evaluated first.

So:

100 → higher priority
200 → lower priority
300 → lower priority

The notes state:

Lower the rule number, higher the priority.

If no rule matches the traffic, the traffic is denied by the implicit rule.

11. Security Group vs NACL

This is a very common interview question.

Feature Security Group NACL
Applied to Resource/ENI Subnet
Stateful Yes No
Allow rules Yes Yes
Deny rules No explicit deny rules Yes
Inbound rules Yes Yes
Outbound rules Yes Yes
Rule priority No numbered rule ordering like NACL Lower number = higher priority
Main purpose Protect resources Control subnet-level traffic

The uploaded notes emphasize the core distinctions: Security Groups are stateful and associated with resources, while NACLs are stateless and applied at subnet level.

12. Easy Way to Remember the Difference

Imagine a company building.

NACL

The NACL is the security gate at the entrance of the building complex.

                NACL
                 ↓
        ┌─────────────────┐
        │     SUBNET      │
        │                 │
        │   EC2    EC2    │
        │                 │
        └─────────────────┘

It controls traffic entering or leaving the entire subnet.

Security Group

The Security Group is the security guard protecting a particular room/building.

Subnet
  │
  ├── EC2
  │    ↑
  │    │
  │ Security Group
  │
  └── EC2

So:

NACL = subnet-level security

Security Group = resource-level security

13. What Happens When Traffic Reaches an EC2 Instance?

Let’s look at the traffic flow.

Suppose an EC2 instance is in a private subnet.

The traffic flow can involve:

EC2
 ↑
Security Group
 ↑
NACL
 ↑
Subnet

The diagram in the notes illustrates the relationship between:

NACL
 ↓
Subnet
 ↓
Security Group
 ↓
EC2

for traffic reaching an EC2 instance.

14. Private EC2 Accessing the Internet

Now let’s follow a real example.

Suppose we have:

EC2
Private Subnet

and the EC2 instance wants to access:

Google

The architecture looks like:

EC2
 │
 ↓
Security Group
 │
 ↓
Private Subnet NACL
 │
 ↓
NAT Gateway
 │
 ↓
Public Subnet NACL
 │
 ↓
Internet Gateway
 │
 ↓
Internet

The notes show this traffic flow step by step on page 3.

15. Outbound Traffic Flow

Let’s break it down.

Step 1 — EC2 Security Group

The EC2 instance first needs to pass its outbound Security Group rule.

EC2
 ↓
Outbound Security Group Rule

If the Security Group allows the traffic, it moves forward.

Step 2 — Private Subnet NACL

The traffic then passes through the outbound rule of the private subnet’s NACL.

Outbound Private NACL

Step 3 — Public Subnet NACL

The traffic reaches the NAT Gateway.

Before reaching the NAT Gateway, the relevant subnet-level NACL rules must allow the traffic.

Step 4 — NAT Gateway

The NAT Gateway translates the private source address and sends the traffic toward the internet.

Step 5 — Public Subnet NACL

The traffic then passes through the relevant outbound rules associated with the public subnet.

Step 6 — Internet Gateway

Finally, the traffic reaches the Internet Gateway and moves toward the internet.

The notes’ diagram shows this sequence from the private EC2 instance through Security Group, private NACL, NAT Gateway, public NACL and onward.

16. What Happens When the Response Comes Back?

Now suppose Google sends a response.

The traffic travels back through the architecture.

Conceptually:

Internet
   ↓
Internet Gateway
   ↓
Public Subnet NACL
   ↓
NAT Gateway
   ↓
Private Subnet NACL
   ↓
Security Group
   ↓
EC2

This is where the difference between stateful Security Groups and stateless NACLs becomes very important.

The Security Group tracks the connection state.

The NACL evaluates the traffic according to its configured inbound/outbound rules.

The notes show this return path on page 3.

17. Creating a Security Group

The notes demonstrate the following process.

Go to:

VPC
 ↓
Security Groups

Then:

Create Security Group

Provide:

Security Group Name
Description
VPC

The screenshot on page 4 shows the AWS console navigation to Security Groups and the Create Security Group screen.

18. Configure Inbound Rules

For the example in the notes, the inbound rules are empty.

That means:

No inbound traffic allowed

through that Security Group.

This is a useful demonstration of how Security Groups can restrict access to a resource.

The notes explicitly show an empty inbound rule configuration.

19. Configure Outbound Rules

The example allows HTTPS:

Protocol:
TCP

Port:
443

Destination:
0.0.0.0/0

So the EC2 instance can initiate HTTPS connections to destinations allowed by the network configuration.

The screenshot in the notes shows this HTTPS port 443 outbound rule.

20. Creating a NACL

Now let’s create a NACL.

Navigate to:

VPC
 ↓
Network ACLs

Then:

Create Network ACL

Provide:

Name
VPC

The notes demonstrate creating a NACL and associating it with the VPC.

21. Configure NACL Inbound Rules

The example in the notes configures an inbound rule allowing all traffic:

Type:
All traffic

Protocol:
All

Port:
All

Source:
0.0.0.0/0

This is the configuration shown in the screenshot on page 7.

Important: Allowing all traffic is a broad rule and should not automatically be copied into a production environment. The example is demonstrating the NACL configuration mechanism.

22. Configure NACL Outbound Rules

Similarly, the notes configure an outbound rule allowing all traffic.

Conceptually:

Outbound
    ↓
All traffic
    ↓
0.0.0.0/0

The screenshot on page 8 shows the outbound rule configuration.

Again, this is the configuration used in the learning example; production environments should use rules appropriate to the actual application requirements.

23. Associate NACL With a Subnet

Creating a NACL isn’t enough.

We also need to associate it with the subnet.

The process shown in the notes is:

NACL
 ↓
Subnet Associations
 ↓
Select Subnet

The screenshot on page 9 shows the NACL being associated with the private subnet.

This is important because:

NACLs are associated with subnets, not individual EC2 instances.

24. Complete Security Architecture

Now let’s combine everything.

                         INTERNET
                             │
                             ↓
                    Internet Gateway
                             │
                             ↓
                    Public Subnet NACL
                             │
                             ↓
                       NAT Gateway
                             │
                             ↓
                   Private Subnet NACL
                             │
                             ↓
                    Security Group
                             │
                             ↓
                       EC2 Instance

For outbound traffic:

EC2
 ↓
Security Group
 ↓
Private NACL
 ↓
NAT Gateway
 ↓
Public NACL
 ↓
Internet Gateway
 ↓
Internet

For return traffic:

Internet
 ↓
Internet Gateway
 ↓
Public NACL
 ↓
NAT Gateway
 ↓
Private NACL
 ↓
Security Group
 ↓
EC2

The page 3 diagram in your notes visually represents these traffic paths and shows where the Security Group and NACL rules are evaluated.

25. Security Group vs NACL: The Simplest Explanation

If you remember only one thing from this article, remember this:

Security Group

Resource-level firewall

Example:

EC2
 ↓
Security Group

It is stateful.

NACL

Subnet-level firewall

Example:

NACL
 ↓
Subnet
 ↓
EC2

It is stateless.

26. A Simple Real-World Example

Imagine a hotel.

NACL = Hotel Main Gate

The main gate controls who can enter and leave the hotel complex.

                    NACL
                     ↓
              ┌─────────────┐
              │    HOTEL    │
              │             │
              │ Room 1      │
              │ Room 2      │
              │ Room 3      │
              └─────────────┘

Security Group = Room Security

Each room can have its own access rules.

Hotel
 │
 └── Room
      │
      └── Security Group

So:

NACL controls the subnet.

Security Group controls access to the resource.

27. Important Interview Questions

What is a Security Group?

A stateful firewall associated with AWS resources that controls inbound and outbound traffic.

What is a NACL?

A stateless network access control mechanism applied at the subnet level.

Is Security Group stateful?

Yes.

Is NACL stateful?

No.

Can Security Groups have deny rules?

Security Groups use allow rules; there is no explicit deny rule.

Can NACLs have deny rules?

Yes.

Where is a NACL applied?

At the subnet level.

Where is a Security Group applied?

To AWS resources/network interfaces such as EC2 instances.

What happens if no NACL rule matches?

The traffic is denied by the implicit deny behavior described in the notes.

Which NACL rule gets higher priority?

The rule with the lower rule number.

28. Final AWS Network Security Diagram

Putting everything together:

                         AWS REGION
                             │
                             ↓
                  ┌────────────────────┐
                  │        VPC         │
                  │  192.168.0.0/23    │
                  └─────────┬──────────┘
                            │
              ┌─────────────┴─────────────┐
              │                           │
              ↓                           ↓
         PUBLIC SUBNET               PRIVATE SUBNET
              │                           │
        Public NACL                 Private NACL
              │                           │
              │                      Security Group
              │                           │
         NAT Gateway                    EC2
              │
              │
       Internet Gateway
              │
              ↓
          INTERNET

The source material’s overall architecture combines these security controls with the previously configured VPC, public/private subnets, route tables and NAT Gateway.

Conclusion

AWS network security becomes much easier once you understand the different responsibilities of Security Groups and NACLs.

Think about them this way:

NACL
 ↓
Protects the SUBNET

Security Group
 ↓
Protects the RESOURCE

And remember their biggest behavioral difference:

Security Group
→ Stateful
→ Allow rules
→ Resource level

NACL
→ Stateless
→ Allow + Deny
→ Subnet level
→ Rule numbers determine priority

When an EC2 instance in a private subnet communicates with the internet, the traffic can pass through multiple layers:

EC2
 ↓
Security Group
 ↓
Private Subnet NACL
 ↓
NAT Gateway
 ↓
Public Subnet NACL
 ↓
Internet Gateway
 ↓
Internet

Understanding this traffic flow is extremely useful when troubleshooting AWS connectivity problems. If an EC2 instance cannot connect to the internet, you can systematically check the Security Group, NACL, route table, NAT Gateway, and Internet Gateway instead of guessing.

The final diagrams in the notes provide a useful visual representation of how these components work together in the VPC architecture.

Suggested SEO Title

AWS Security Groups vs NACL: Complete Guide with Traffic Flow

Suggested URL Slug

aws-security-groups-vs-nacl

Suggested Meta Description

Learn AWS Security Groups and NACLs with simple examples. Understand stateful vs stateless firewalls, subnet-level security, traffic flow, rules, priorities, and EC2 network security.

Tags: , , , , ,

Leave a Reply