What is the difference between Security Groups and Network ACLs (NACLs) in AWS VPCs?
❓ Interview Prompt: Compare stateful Security Groups (instance-level) vs stateless Network ACLs (subnet-level boundary firewalls).
Security Groups and Network ACLs (NACLs) provide multi-layered firewall protection inside an AWS VPC:
| Feature | Security Group (SG) | Network ACL (NACL) |
|---|---|---|
| Operating Boundary | Virtual Interface / Instance level | Subnet Boundary level |
| Statefulness | Stateful (Inbound approval automatically allows return outbound traffic) | Stateless (Inbound and outbound rules evaluated separately) |
| Rule Types | ALLOW rules only (Everything denied by default) | ALLOW and DENY rules |
| Evaluation | Evaluates all rules before deciding | Evaluates rules in numerical order (first match wins) |
Code Implementation Example
# Stateful Security Group allowing HTTPS inbound
resource "aws_security_group" "web_sg" {
name = "web-server-sg"
vpc_id = aws_vpc.main.id
ingress {
from_port = 443
to_port = 443
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
# Return outbound traffic is automatically allowed due to statefulness!
}Security Groups are stateful firewalls at the instance level; NACLs are stateless firewalls at subnet boundaries.