EN_AWS_Network

AWS Network ACL vs Security Group

The behavioral differences between the Stateful Security Group and the Stateless Network ACL, and VPC traffic flow, written as interview Q&A.

---

Q6. What's the Difference Between Network ACL and Security Group?

One-line answer: A Security Group is a per-instance stateful firewall (allow rules only, auto-allows outbound responses, evaluates all rules); a Network ACL is a per-subnet stateless firewall (supports both allow and deny, evaluated by rule number order, requires explicit response rules).

Security Group(Stateful)	AWS Network ACL(Stateless)
Applied per instance (first layer of security)	Applied per subnet (second layer of security)
Only supports allow rules	Supports both allow and deny rules
Automatically allows responses to outbound requests	Requires explicit rule for outbound responses
Evaluates all rules to allow traffic	Allows or denies traffic based on rule number order
Applies only to specified instances	Automatically applies to all instances in the subnet

flowchart TB
    subgraph Region
        subgraph VPC ["VPC (10.0.0.0/16)"]

            IGW((("Internet Gateway")))

            Router[("Router")]

            IGW <--> Router

            subgraph Subnet1 ["Subnet"]
                SG1["Security Group"]
                EC2_1A(["EC2"])
                EC2_1B(["EC2"])
                SG1 <--> EC2_1A
                SG1 <--> EC2_1B
            end

            subgraph Subnet2 ["Subnet"]
                SG2["Security Group"]
                EC2_2A(["EC2"])
                EC2_2B(["EC2"])
                SG2 <--> EC2_2A
                SG2 <--> EC2_2B
            end

            RouteTable1["Route Table"]
            RouteTable2["Route Table"]

            ACL1[("Network ACL")]
            ACL2[("Network ACL")]

            Router <--> RouteTable1 <--> ACL1 <--> Subnet1
            Router <--> RouteTable2 <--> ACL2 <--> Subnet2
        end
    end

Loading

Limits

• Network ACL

  • Up to 200 Network ACLs can be created per VPC.
  • Each Network ACL can register up to 20 inbound and 20 outbound rules including the default deny rule. The limit can be raised to 40, but the added rules increase the processing workload and may affect network performance.

• Security Group

  • Up to 2,500 Security Groups can be created per VPC.
  • Each Security Group can register up to 60 inbound and 60 outbound rules.
  • Up to 5 Security Groups can be attached to a single instance network interface.

→ Back to List