L7. Security Groups, NACLs & Network Segmentation

Two Firewalls, Two Different Jobs

A VPC gives you two layers of traffic filtering, and the exam leans heavily on the ways they differ. Security groups operate at the instance/ENI level and are stateful: if you allow inbound traffic on a port, the response traffic is automatically permitted back out, with no matching outbound rule required. Security groups only support Allow rules. There is no way to write an explicit Deny; you can only choose what to allow. Network ACLs (NACLs) operate one layer higher, at the subnet boundary, and they are stateless. Because there is no connection tracking, you must explicitly allow both the inbound request and the outbound response, or return traffic silently drops. NACLs support both Allow and Deny rules, and they are evaluated in ascending rule-number order, stopping at the first rule that matches. Rule ordering is not cosmetic here: a Deny placed after a broader Allow never gets a chance to fire.

Defaults Matter

A newly created security group denies all inbound traffic and allows all outbound traffic by default. A newly created custom NACL denies everything, both directions, until you add rules. The default NACL that ships with a VPC is the exception: it allows all traffic by default, which is why security teams routinely lock it down or replace it with custom NACLs as a hardening step.

Referencing Security Groups as Sources

Instead of hardcoding a CIDR block, a security group rule can name another security group as its source or destination. This is the standard pattern for tiered applications: the database security group's inbound rule allows port 3306 only from the app-tier security group, not from a subnet range. As instances scale in and out of the app tier, the rule stays correct automatically, since it is tracking group membership rather than IP addresses.

Building Tiers With Subnets

Combine these controls into a multi-tier segmentation pattern spread across multiple Availability Zones for resilience:

A compromised load balancer in the public tier cannot reach the database directly if the isolated subnet's route table has no path out, and NACLs at each subnet boundary add a second layer of enforcement independent of whatever security groups are attached to the instances themselves. Exam tip: When a question asks how to explicitly block a single malicious IP address while leaving everything else untouched, the answer is always a NACL Deny rule, numbered ahead of the broader Allow rule. Security groups cannot express "deny this one thing," only "allow this and nothing else," so they are the wrong tool whenever the question uses the word "block" or "deny" for a specific source.