Security Groups vs Network ACLs: Stateless vs Stateful Firewalls

Security groups and network ACLs both filter traffic in a VPC, but they operate at different layers with different rules. Exam questions frequently hinge on one fact: security groups are stateful and allow-only; NACLs are stateless and support explicit denies.

Security groups — instance-level, stateful

A security group is a virtual firewall attached to an ENI (instances, load balancers, RDS, Lambda-in-VPC, etc.). It is stateful: if you allow inbound traffic, the response is automatically allowed out regardless of outbound rules, and vice versa. Rules are allow-only — you cannot write 'deny this IP.'

Multiple security groups can attach to one resource, and rules reference other security groups as sources — the standard way to allow web-tier → app-tier traffic.

Network ACLs — subnet-level, stateless

A NACL applies to every resource in a subnet. It is stateless: return traffic must be explicitly allowed in both directions (ephemeral ports matter). Rules are numbered and evaluated in order, and — crucially — support both allow AND deny.

The classic exam answer: 'block a specific malicious IP' → NACL deny rule, because security groups cannot deny.

How to remember it

• SG = instance-level, stateful, allow-only
• NACL = subnet-level, stateless, allow + deny, numbered rules
• Ephemeral ports: NACLs need outbound ephemeral-port ranges open for return traffic