🔒

Network ACLs vs Security Groups

Medium

Free preview · 2 of 5 steps

Two layers of cloud firewall

AWS provides two firewall mechanisms: Network ACLs act at the subnet boundary and Security Groups act at the instance level. They differ in a fundamental way: NACLs are stateless (each packet evaluated independently), while Security Groups are stateful (connection tracking — return traffic is automatically allowed).

Understanding the difference prevents a common misconfiguration: NACLs that silently drop return traffic.

Packets in motion — click to inspect:

1 / 2

Space to play/pause · ← → to step