Service comparisons / Security groups vs Network ACLs
Security groups vs network ACLs
Security groups are stateful allow-only firewalls on each network interface; network ACLs are stateless subnet-level rules that can also deny. How they differ and which one a question needs.
Last checked against AWS documentation · How we write our content
| Question | Security groups | Network ACLs |
|---|---|---|
| Applies to | Each network interface (EC2, RDS, Lambda in a VPC, load balancers) | Every resource in the subnet |
| State | Stateful; return traffic is allowed automatically | Stateless; return traffic needs its own rule |
| Rules | Allow rules only | Allow and deny rules |
| Evaluation | All rules together; traffic is allowed if any rule allows it | In number order; the first matching rule wins |
| Defaults | New groups allow all outbound and no inbound | The default ACL allows everything; a new custom ACL denies everything |
| Best for | Least-privilege access between tiers, by referencing other security groups | Blocking specific IP ranges, and a coarse second layer |
Both filter traffic in a VPC, and well-designed networks use both. Exam questions test the differences: where each applies, whether it remembers connections, and whether it can deny.
How to choose
- “Allow only the web tier to reach the database”: a security group rule on the database that references the web tier’s security group, not its IPs.
- “Block this malicious IP address”: a network ACL deny rule. Security groups can’t deny.
- Defense in depth: security groups for fine-grained access, network ACLs as a subnet-wide guardrail.
Exam traps
- A network ACL that allows inbound port 443 but not outbound ephemeral ports (1024 to 65535) breaks responses. Security groups don’t have this problem.
- In a network ACL, a deny rule with a higher number than an allow rule for the same traffic never takes effect. Rule order matters.
- Changing a security group affects running instances right away, with no restart.
- VPC Flow Logs show ACCEPT and REJECT records. A REJECT on the return path usually points to a network ACL.