Case ABF57C · Cloud · L1 Foundations
Security Groups vs Network ACLs
Interview questionWhat is the difference between a security group and a network ACL in AWS?
- 01 What is it?
- 02 How is it abused?
- 03 How do you stop it?
What a strong answer covers
Try it out loud first. Then check yourself:
- Security groups attach to network interfaces (instances) and are stateful: allow a request in and the reply is allowed out.
- Security groups only have allow rules; anything not allowed is denied.
- Network ACLs cover a whole subnet, are stateless (replies need their own rule), have allow and deny, and run in order.
- Use security groups as the main control, referencing other groups instead of IP ranges; use NACLs as a coarse extra layer.
If the interviewer pushes back
- Why is a security group that allows SSH from 0.0.0.0/0 still common, and what is the better way to reach the instance?