Network ACLs overview in AWS - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a Network ACL in AWS using Terraform.

AWS

resource "aws_network_acl" "example" {
  vpc_id = "[1]"
}

Drag options to blanks, or click blank then click option'

Avpc-123abc

Bsubnet-456def

Csg-789ghi

Deni-012jkl

Attempts:

3 left

💡 Hint

Common Mistakes

Using a subnet ID instead of a VPC ID

Using a security group ID instead of a VPC ID

The vpc_id must reference the VPC where the Network ACL will be created. Using a subnet ID or security group ID is incorrect.

2fill in blank

medium

Complete the code to add an inbound rule allowing HTTP traffic on port 80.

AWS

resource "aws_network_acl_rule" "allow_http_inbound" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 100
  protocol       = "[1]"
  rule_action   = "allow"
  egress        = false
  cidr_block    = "0.0.0.0/0"
  from_port     = 80
  to_port       = 80
}

Drag options to blanks, or click blank then click option'

Aicmp

Budp

Ctcp

Dall

Attempts:

3 left

💡 Hint

Common Mistakes

Setting protocol to UDP or ICMP instead of TCP

Using 'all' which allows all protocols, not specific to HTTP

HTTP uses TCP protocol on port 80, so the protocol must be set to "tcp".

3fill in blank

hard

Fix the error in the rule that blocks all outbound traffic.

AWS

resource "aws_network_acl_rule" "deny_all_outbound" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 200
  protocol       = "[1]"
  rule_action   = "deny"
  egress        = true
  cidr_block    = "0.0.0.0/0"
  from_port     = 0
  to_port       = 0
}

Drag options to blanks, or click blank then click option'

Aany

B0

Call

D-1

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'all' or 'any' instead of '-1' for all protocols

Using '0' which is invalid for protocol

To block all protocols, the protocol must be set to "-1" in AWS Network ACL rules.

4fill in blank

hard

Fill both blanks to create a rule allowing inbound SSH traffic from a specific IP.

AWS

resource "aws_network_acl_rule" "allow_ssh_inbound" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 110
  protocol       = "[1]"
  rule_action   = "allow"
  egress        = false
  cidr_block    = "[2]"
  from_port     = 22
  to_port       = 22
}

Drag options to blanks, or click blank then click option'

Atcp

Budp

C203.0.113.0/24

D0.0.0.0/0

Attempts:

3 left

💡 Hint

Common Mistakes

Using UDP instead of TCP for SSH

Using 0.0.0.0/0 which allows all IPs instead of a specific range

SSH uses TCP protocol on port 22, and the CIDR block must specify the allowed IP range, here a specific subnet.

5fill in blank

hard

Fill all three blanks to create a Network ACL rule that denies outbound ICMP traffic to a specific subnet.

AWS

resource "aws_network_acl_rule" "deny_icmp_outbound" {
  network_acl_id = aws_network_acl.example.id
  rule_number    = 150
  protocol       = "[1]"
  rule_action   = "[2]"
  egress        = [3]
  cidr_block    = "192.168.1.0/24"
  from_port     = -1
  to_port       = -1
}

Drag options to blanks, or click blank then click option'

Aicmp

Bdeny

Ctrue

Dallow

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allow' instead of 'deny' for blocking

Setting egress to false for outbound rules

Using wrong protocol name

ICMP protocol is specified as "icmp". To block traffic, the action is "deny". Outbound rules have egress set to true.