AWS Certified CloudOps Engineer - Associate
Security Groups and Network ACLs
Two firewalls guard every packet in a VPC, and they disagree about almost everything: where they sit, whether they can deny, how their rules are read, and whether replies come back for free. This lesson makes the boundary between them sharp enough to answer a scenario question in one pass.
Intermediate 30 minutes 6 Learning Objectives
- Contrast security groups and network ACLs across placement, rule types, evaluation order, and statefulness
- Explain why a stateless network ACL needs an ephemeral port rule and calculate the range for a given client
- Predict the default behavior of a new security group, the default security group, a default network ACL, and a custom network ACL
- Use security group referencing correctly and identify the case where it silently fails
- Diagnose why removing a security group rule does not always drop an existing connection
- Choose the correct control for a scenario, including cases where only one of the 2 can express the requirement