VPC security layers: subnets, security groups, and network ACLs

Layers of control

A VPC gives you several independent controls over network traffic. Each works at a different level, and secure designs usually combine them:

• Route tables decide where traffic from a subnetSubnetA range of IP addresses in a VPC, inside one Availability Zone. A subnet is public when its route table sends internet traffic to an internet gateway, and private when it does not.Glossary entryClose can go.
• Security groupsSecurity groupA stateful virtual firewall for network interfaces, such as an EC2 instance's, whose rules can only allow traffic. Return traffic for allowed connections is allowed automatically, and a rule can refer to another security group instead of IP addresses.Glossary entryClose filter traffic to and from individual resources.
• Network ACLsNetwork ACLA stateless firewall for a subnet, with numbered allow and deny rules checked in order. Because it is stateless, return traffic needs its own rule, usually for a range of ephemeral ports.Glossary entryClose filter traffic entering and leaving whole subnets.

Public and private subnets

A subnet is public when its route table has a route to an internet gateway. A private subnet has no such route, so resources in it cannot be reached directly from the internet. A common pattern places load balancers in public subnets and application servers and databases in private subnets.

Outbound access from private subnets

Instances in a private subnet often still need to reach the internet, for example to download software updates. A public NAT gatewayNAT gatewayA managed VPC component that lets instances in private subnets start connections to the internet or other networks, while blocking connections started from outside. It is billed per hour and per gigabyte processed.Glossary entryClose solves this. The instances can open connections to the internet, but they cannot receive unsolicited inbound connections. Connections always start from inside the VPC.

NAT gateways come in two availability modes:

• A zonal NAT gateway runs in one Availability ZoneAZ (Availability Zone)An isolated location within an AWS Region, made up of one or more data centers with their own power, cooling, and networking. The AZs in a Region are linked by fast, low-latency connections, so spreading resources across them protects against the failure of one site.Glossary entryClose. Create it in a public subnet with an Elastic IPIP (Internet Protocol)The protocol that addresses and routes packets between networks. Each device has an IP address: IPv4 addresses look like 192.0.2.1, and IPv6 addresses are longer, like 2001:db8::1.Glossary entryClose address, and in the private subnet's route table send internet-bound traffic (0.0.0.0/0) to it. It is redundant only within its own zone, so for high availabilityHA (High availability)The ability of a system to keep serving users when parts of it fail, usually by running redundant copies across Availability Zones and failing over automatically. It is often stated as a percentage of uptime, such as 99.99%.Glossary entryClose create one in each Availability Zone and route each private subnet to the NAT gateway in its zone.
• A regional NAT gateway expands across Availability Zones automatically as your workloads do, and it does not need a public subnet, although the VPC still needs an internet gateway. Private subnets in every zone can route to the same NAT gateway. Regional NAT gateways don't support private NATNAT (Network address translation)Rewriting the IP addresses in packets as they pass through a device, most often so that many private addresses can share one public address to reach the internet.Glossary entryClose; use a zonal NAT gateway for private connectivity.

Many existing architectures and practice scenarios use the zonal design, so learn both.

If the instances only need Amazon S3 or Amazon DynamoDB, a gateway VPC endpointVPC endpointA private connection from a VPC to an AWS service or another endpoint service without crossing the internet. Gateway endpoints, for Amazon S3 and DynamoDB, are route table targets; interface endpoints are network interfaces that use AWS PrivateLink.Glossary entryClose is another option. It provides access to those two services without an internet gateway or NAT device, at no additional charge. Gateway endpoints do not provide general internet access.

Security groups

A security group acts as a virtual firewall for the resources it is associated with, such as EC2 instances.

• Rules can only allow traffic. You cannot write a deny rule.
• A new security group has no inbound rules, so it allows no inbound traffic until you add rules. It allows all outbound traffic by default.
• Security groups are statefulStatefulKeeping track of earlier requests or connections. A stateful firewall, such as a security group, remembers allowed connections and lets their return traffic back in automatically.Glossary entryClose. If a request is allowed in, the response is allowed out automatically, and the other way round.
• A rule can reference another security group instead of an IP range.

Referencing security groups is how tiered applications are usually secured. The load balancer's group allows HTTPSHTTPS (HTTP Secure)HTTP sent over a TLS-encrypted connection, so that requests and responses cannot be read or changed on the way, and the server proves its identity with a certificate.Glossary entryClose from the internet, the web servers' group allows traffic only from the load balancer's group, and the database group allows traffic only from the web servers' group.

Network ACLs

A network ACL controls traffic at the subnet boundary. Every subnet is associated with exactly one network ACL.

• Rules can allow or deny traffic.
• Each rule has a number. Rules are evaluated in order, starting with the lowest number, and the first rule that matches is applied.
• Network ACLs are statelessStatelessKeeping no memory of earlier requests, so that each one is handled on its own. Any copy of a stateless web server can handle any request, which makes scaling easy; a stateless firewall, such as a network ACL, needs a rule for return traffic too.Glossary entryClose. Allowing inbound traffic does not automatically allow the response, so you need matching outbound rules.

Responses go to the client's ephemeral port, a high port the client picks (1024-65535 covers all common clients). That gives two classic failures with a custom network ACL:

• Servers in the subnet answer clients, for example HTTPS on 443 from the internet: add an outbound rule allowing TCPTCP (Transmission Control Protocol)The transport protocol that delivers data reliably and in order: it sets up a connection first and resends lost packets. HTTP, SSH, and most database connections run over TCP.Glossary entryClose 1024-65535 to the clients.
• Instances in the subnet call out, for example to an APIAPI (Application programming interface)A defined way for one program to ask another for data or actions, such as a set of HTTPS requests and responses. Every AWS service is controlled through its API, which the console, the CLI, and the SDKs call for you.Glossary entryClose on 443: add an inbound rule allowing TCP 1024-65535 from the destination, for the responses.

Security groups need neither rule, because they are stateful.

Because they support deny rules, network ACLs are the tool for blocking a specific IP address range at the subnet level. Put the deny rule at a lower number than the rule that allows the traffic.

Comparing the two

	Security group	Network ACL
Applies to	Associated resources	A whole subnet
Rule types	Allow only	Allow and deny
State	Stateful	Stateless
Rule evaluation	All rules together	In number order; first match wins
Return traffic	Allowed automatically	Needs a rule for ephemeral ports (1024-65535)

Filtering web requests

Security groups and network ACLs work with IP addresses, ports, and protocols. To filter web requests by their content, for example to block common attack patterns, use AWS WAF. AWS WAF protects resources such as Amazon CloudFront distributions, Application Load Balancers, and Amazon API Gateway RESTREST (Representational state transfer)A style of web API in which resources are named by URLs and handled with standard HTTP methods, such as GET, PUT, and DELETE, and the server keeps no session state between requests. Amazon API Gateway builds REST APIs.Glossary entryClose APIs. It cannot be associated directly with an EC2 instance.

Key takeaways

• A subnet is public only if its route table points to an internet gateway.
• Use a NAT gateway for outbound-only internet access from private subnets: a zonal NAT gateway in a public subnet in each Availability Zone, or one regional NAT gateway.
• Security groups allow only and are stateful; network ACLs allow and deny, are stateless, and are evaluated in rule order.
• With a custom network ACL, allow ephemeral ports (1024-65535) in the opposite direction for responses: outbound when the subnet serves clients, inbound when it calls out.
• Block a specific IP range with a network ACL deny rule, not a security group.
• Use AWS WAF in front of web applications, through a supported service such as an Application Load Balancer.

Sources

• Amazon VPC User Guide: NAT gateways
• Amazon VPC User Guide: Regional NAT gateways
• AWS PrivateLink Guide: Gateway endpoints
• Amazon VPC User Guide: Security groups
• Amazon VPC User Guide: Security group rules
• Amazon VPC User Guide: Network ACLs
• Amazon VPC User Guide: Custom network ACLs for your VPC
• AWS WAF Developer Guide: Resources that you can protect