whats the difference between security groups and nacl

Question

Accepted Answer

Security groups and NACLs are both used for network security in AWS, but they operate at different levels of the network stack.

Security groups are stateful and operate at the instance level, controlling inbound and outbound traffic based on port, protocol, and IP addresses.
NACLs are stateless and operate at the subnet level, controlling traffic based on subnet IP addresses, port ranges, and protocol numbers.
Security groups are evaluated before NACLs, and if a security group allows traffic, the NACL rules are not evaluated for that traffic.
Security groups are more flexible and easier to manage, while NACLs provide an additional layer of security and can be used for more granular control.
Example: Security groups can be used to allow SSH access to an EC2 instance, while NACLs can be used to restrict access to a specific range of IP addresses.

Accepted Answer

SGs associate with EC2 instances and NACL associate with subnets.SGs are stateless and NAcl are stateful. All the SGs inbound rules ae evaluated before making a connection to the instance, whereas NACL inbound rules are evaluated as per order starting from lowst number. SGs are first level of defence. NACL are 2nd level of defence.

whats the difference between security groups and nacl

Top CtrlS AWS Engineer interview questions & answers

Popular interview questions of AWS Engineer