Network ACL

1. Applied to a subnet in a VPC
2. Gets evaluated before traffic reaches an EC2 Network interface
3. Applies to all resources in a subnet
4. Rules are numbered and applied from lowest and highest
5. Can have both allow and deny rules
6. Stateless ?- inbound traffic does not automatically allow outbound traffic

Example:

• Allow inbound TCP 80 from 0.0.0.0/0
• Deny inbound from a specific IP range

Security Group

• Stateful - if you allow inbound, the response traffic is automatically allowed out (and vice versa)
• Applied at Instance level
• Tied to resources (EC2, ENI, RDS, Lambda in VPC, etc.)
• No explicit deny rules, if not allowed than by default it is denied
• Rules are evaluated as a whole (no order/priority).

Example:

• Allow inbound TCP 443 from 0.0.0.0/0
• Allow inbound TCP 22 from corporate IP