What is the difference between Security Groups and NACLs?
Learn the key differences between AWS Security Groups and NACLs: stateful vs stateless, instance vs subnet level, and allow vs deny rules for secure VPCs.
Expected Interview Answer
Security Groups are stateful firewalls that operate at the instance (ENI) level and allow only 'allow' rules, while Network ACLs are stateless firewalls that operate at the subnet level and support both allow and deny rules.
Because a Security Group is stateful, return traffic for an allowed inbound request is automatically permitted regardless of outbound rules. A NACL is stateless, so you must explicitly allow both the inbound request and the outbound return traffic, and its numbered rules are evaluated in order. Security Groups evaluate all rules together and are attached to instances, whereas NACLs are attached to subnets and act as a second, coarser layer of defense.
- Layered defense: subnet-level NACL plus instance-level Security Group
- Security Groups simplify config with stateful return traffic
- NACLs can explicitly deny malicious IPs at the subnet edge
- Rule ordering in NACLs gives fine-grained precedence control
- Clear separation of broad vs. targeted network policy
AI Mentor Explanation
A Security Group is like the on-field umpire deciding per batter whether each delivery is legal, and once a ball is allowed the return throw back to the keeper is automatically fine. A NACL is the boundary rope steward at the ground gate who checks everyone entering and leaving the stadium separately, applying a numbered rulebook to each direction independently.
Step-by-Step Explanation
Step 1
Identify the layer
Security Groups attach to instance ENIs; NACLs attach to subnets. Pick the layer the rule belongs to.
Step 2
Choose stateful vs. stateless
Security Groups auto-allow return traffic (stateful); NACLs need explicit inbound and outbound rules (stateless).
Step 3
Define allow/deny
Security Groups only allow; NACLs support both allow and deny, useful for blocking specific IP ranges.
Step 4
Order NACL rules
NACL rules are numbered and evaluated lowest-first; the first match wins, so plan rule numbers carefully.
Step 5
Combine for defense-in-depth
Use a broad NACL at the subnet edge and tight Security Groups at each instance.
What Interviewer Expects
- Stateful vs. stateless distinction explained correctly
- Instance-level vs. subnet-level scope
- Allow-only vs. allow-and-deny rules
- Understanding of NACL rule ordering and evaluation
- Awareness of defense-in-depth layering
Common Mistakes
- Claiming Security Groups support deny rules
- Forgetting NACLs need explicit return-traffic rules
- Thinking NACLs are stateful like Security Groups
- Confusing which resource each is attached to
- Ignoring NACL rule number precedence
Best Answer (HR Friendly)
“A Security Group is a firewall around a single server that remembers connections, so if it lets traffic in, the reply gets out automatically. A Network ACL is a firewall around a whole subnet that checks each direction separately and can also explicitly block bad addresses, giving you two layers of protection.”
Code Example
aws ec2 authorize-security-group-ingress \
--group-id sg-0abc123 \
--protocol tcp --port 443 \
--cidr 0.0.0.0/0# Deny a malicious IP first (lower rule number = higher priority)
aws ec2 create-network-acl-entry \
--network-acl-id acl-0def456 \
--rule-number 90 --protocol -1 \
--cidr-block 203.0.113.10/32 --rule-action deny --ingress
# Allow inbound HTTPS
aws ec2 create-network-acl-entry \
--network-acl-id acl-0def456 \
--rule-number 100 --protocol tcp \
--port-range From=443,To=443 \
--cidr-block 0.0.0.0/0 --rule-action allow --ingress
# Must also allow outbound return traffic (ephemeral ports)
aws ec2 create-network-acl-entry \
--network-acl-id acl-0def456 \
--rule-number 100 --protocol tcp \
--port-range From=1024,To=65535 \
--cidr-block 0.0.0.0/0 --rule-action allow --egressFollow-up Questions
- Why must you configure ephemeral port ranges in NACL outbound rules?
- What happens if a Security Group and NACL give conflicting decisions?
- How are NACL rules evaluated when multiple rules match?
- Can a single instance belong to multiple Security Groups?
- When would you use a NACL deny rule instead of a Security Group?
MCQ Practice
1. Which statement about Security Groups is true?
Security Groups are stateful (return traffic is automatic) and support only allow rules, attached at the instance ENI level.
2. At what level does a Network ACL operate?
NACLs are attached to subnets and filter traffic entering or leaving that subnet.
3. Why must NACLs define outbound rules for inbound requests?
NACLs are stateless, so return traffic is not automatically allowed and must be permitted explicitly, typically on ephemeral ports.
Flash Cards
Security Group: stateful or stateless? — Stateful — return traffic for allowed connections is automatically permitted.
NACL: what scope and rule types? — Subnet level; stateless; supports both allow and deny rules evaluated by rule number.
Which can explicitly deny an IP? — NACLs (via deny rules). Security Groups are allow-only.
How are NACL rules evaluated? — By ascending rule number; the first matching rule wins.