Security groups vs network ACLs, explained

AWS gives every VPC two built-in traffic filters: network ACLs and security groups. They look alike, but they sit at different levels and follow different rules. Here is how each one works, and the reply-traffic mistake that catches people out, with links to the AWS documentation itself.

1. What it is

   Two filters at two levels.

   A network ACL allows or denies traffic at the subnet level. A security group works at the instance level: it is attached to instances (strictly, their network interfaces) and other resources, and one instance can have several. Traffic arriving from an internet gateway is checked against the subnet's network ACL, then against the instance's security group, so it has to pass both. Two exceptions worth knowing: network ACLs are evaluated only as traffic enters or leaves a subnet, so instances talking inside one subnet meet only their security groups, and neither filter applies to some AWS-provided services such as Amazon DNS, DHCP and instance metadata.

   Source: AWS, Amazon VPC User Guide, Compare security groups and network ACLs

2. How it works

   Allow-only vs first match wins.

   A security group has allow rules only, and it evaluates all of them before deciding (several security groups on one resource are combined into one set). A network ACL has numbered rules that can allow or deny. AWS checks them from the lowest number up, applies the first rule that matches, and ignores any later rule that contradicts it. A final rule numbered * denies anything no other rule matched. In AWS's own example, a packet for port 443 skips rule 100 (port 80) and is allowed by rule 110 (port 443). Note that a VPC's default network ACL allows all traffic out of the box, so the * rule only starts to bite once you add a custom ACL or tighten the default one.

   Source: AWS, Amazon VPC User Guide, Network ACL rules; Custom network ACLs

3. Why it matters

   Network ACLs don't remember replies.

   Security groups are stateful: if inbound traffic is allowed, the response is allowed back out regardless of the outbound rules. Network ACLs are stateless, so responses are not automatically allowed. AWS's rule of thumb: for every rule you add, there must be a rule that allows the response traffic. A reply goes back to the port the client picked, an ephemeral port whose range depends on the client's operating system, which is why AWS's example outbound rule allows a port range (32768-65535) rather than one port. Allow port 443 in on a custom ACL without that outbound rule, and the server's replies are dropped at the subnet edge, so the client never gets an answer.

   Source: AWS, Amazon VPC User Guide, Network ACL basics; Custom network ACLs

The takeaway: A network ACL guards the subnet and a security group guards the instance. ACL rules run in number order and the first match wins, while security groups only allow and weigh every rule. Security groups remember connections and network ACLs don't, so a custom ACL needs rules in both directions. AWS recommends security groups as the primary control, with network ACLs as a secondary, coarse-grain layer, for example to deny a specific subset of traffic.

More short lessons

ADIR also offers a free external pen test for cloud teams: see the offer.

Transcript

In AWS, two firewalls guard your servers. They look alike, but they follow very different rules. A network ACL guards a subnet. A security group guards each instance inside it. Traffic from the internet passes the subnet's ACL first, then the instance's security group. Both have to let it through. Their rules work differently, too. A security group only has allow rules, and it weighs all of them. A network ACL can allow or deny. It checks numbered rules from lowest to highest, and the first match wins. Anything unmatched hits the final deny. The biggest difference is memory. A security group is stateful, so replies go out automatically. A network ACL is stateless. Allow requests in on port 443, forget a rule for the replies, and they're dropped. The connection fails. So, the ACL guards the subnet, and the security group guards the instance. ACL rules run in order, first match wins. And only security groups remember replies, so ACLs need rules both ways.

Narrated with an AI voice.