Security groups vs NACLs decision in AWS - Visual Side-by-Side Comparison

Process Flow - Security groups vs NACLs decision

Start: Incoming Traffic

↓

Check NACL Rules

↓

Check SG Rules

↓

End

Traffic first passes through NACL rules, then security group rules. Both must allow traffic for it to reach the resource.

Execution Sample

AWS

NACL: Allow inbound port 80
SG: Allow inbound port 80
Traffic arrives on port 80
Check NACL -> Allowed
Check SG -> Allowed
Traffic reaches server

This example shows traffic allowed by both NACL and security group, so it reaches the server.

Process Table

Step	Traffic Port	NACL Rule Check	NACL Result	SG Rule Check	SG Result	Final Outcome
1	80	Allow inbound 80	Allowed	Allow inbound 80	Allowed	Traffic reaches server
2	22	Deny inbound 22	Denied	Allow inbound 22	Allowed	Traffic blocked by NACL
3	443	Allow inbound 443	Allowed	Deny inbound 443	Denied	Traffic blocked by SG
4	8080	No rule for 8080	Denied (default deny)	Allow inbound 8080	Allowed	Traffic blocked by NACL

💡 Traffic must be allowed by both NACL and SG to reach the server; any deny blocks it.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4
Traffic Port	None	80	22	443	8080
NACL Result	None	Allowed	Denied	Allowed	Denied
SG Result	None	Allowed	Allowed	Denied	Allowed
Final Outcome	None	Reach Server	Blocked	Blocked	Blocked

Key Moments - 3 Insights

Why does traffic get blocked even if the security group allows it?

Because the NACL denies the traffic first, as shown in step 2 and 4 of the execution_table, NACL rules are evaluated before security groups.

Can security groups allow traffic that NACL denies?

No, traffic must pass both NACL and security group rules. If NACL denies, traffic is blocked regardless of security group settings (see step 2 and 4).

What happens if there is no explicit rule in NACL for a port?

NACLs have an implicit deny rule. If no rule matches, traffic is denied by default (step 4).

Visual Quiz - 3 Questions

Look at the execution_table, what is the final outcome for traffic on port 443?

A Traffic reaches server

B Traffic blocked by NACL

C Traffic blocked by security group

D Traffic allowed by default

💡 Hint

Check row 3 in execution_table under SG Result and Final Outcome columns.

At which step does the NACL deny traffic even though the security group allows it?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at NACL Result and SG Result columns in execution_table rows 2 and 4.

If the NACL allowed port 22 instead of denying it, what would be the final outcome at step 2?

A Traffic reaches server

B Traffic blocked by security group

C Traffic blocked by NACL

D Traffic blocked by default deny

💡 Hint

Consider that both NACL and SG must allow traffic for it to reach the server (see execution_table step 1).

Concept Snapshot

Security groups and NACLs control traffic in AWS.
NACLs act as a firewall at subnet level, evaluated first.
Security groups act at instance level, evaluated second.
Traffic must be allowed by both to reach the resource.
NACLs have stateless rules; security groups are stateful.
Default deny applies if no rule matches in NACL.

Full Transcript

In AWS, when traffic arrives, it first passes through Network ACL (NACL) rules which are stateless and apply at the subnet level. If the NACL allows the traffic, it then passes to the security group rules which are stateful and apply at the instance level. Both must allow the traffic for it to reach the server. If either denies, the traffic is blocked. For example, traffic on port 80 allowed by both NACL and security group reaches the server. Traffic on port 22 denied by NACL is blocked even if the security group allows it. Traffic on port 443 allowed by NACL but denied by security group is blocked. If no NACL rule matches, traffic is denied by default. This layered approach helps secure AWS resources effectively.