Start with scope, state and rule behavior
A security group is associated with supported resources through their network interfaces. It is normally the precise, workload-level control: allow HTTPS to a load balancer, allow application traffic only from the load-balancer security group, and allow database traffic only from the application security group.
A network ACL is associated with a subnet. Every resource using that subnet crosses the same ACL boundary. It is a coarser control that can allow or deny CIDR-based traffic and can act as a subnet guardrail.
Workload-specific access or security-group references: security group. Ordered subnet-wide allow or deny rule: network ACL. Defense in depth: use both, with security groups as the primary control.
Security group vs network ACL comparison
Why statefulness changes the answer
Assume a client opens an HTTPS connection to a server on TCP port 443. The server sends the response back to the client’s temporary, or ephemeral, source port. A security group tracks the approved connection, so response traffic is automatically allowed. A network ACL evaluates the response as a separate packet; the return direction therefore needs an applicable allow rule.
Client 198.51.100.10:53124 → Server 10.0.2.20:443 Server 10.0.2.20:443 → Client 198.51.100.10:53124
The specific ephemeral range depends on the client operating system or service. In an architecture question, identify which side initiated the connection and which subnet ACL sees the return packet before selecting a port range.
Three-tier architecture example
Consider an internet-facing Application Load Balancer, private application instances and a private PostgreSQL database. Use security-group references to express application intent without maintaining instance IP lists.
ALB security group
Allow inbound TCP 443 from approved client CIDRs or the internet, depending on the application.
Application security group
Allow the application port only from the ALB security group.
Database security group
Allow TCP 5432 only from the application security group.
This pattern follows identity through the tiers: internet clients do not receive direct access to application or database ports. If an application instance is replaced and receives a different private IP, the security-group relationship still expresses the intended source.
Where a network ACL can help
A custom ACL can add a subnet-wide deny for a known unwanted CIDR or provide coarse ingress and egress boundaries. Because its numbered rules stop at the first match, place specific rules before broader rules and leave numbering gaps for later changes. Do not use a NACL as a substitute for precise workload rules.
Production-style failure: HTTPS request times out
Symptoms
An application instance in a private subnet initiates HTTPS to an external API. DNS resolves, the route reaches a NAT gateway, and the security group allows outbound TCP 443, but the request times out.
Reasoning path
- Confirm the route: verify the private route table sends the destination toward the expected NAT path.
- Check the stateful control: outbound TCP 443 is permitted by the instance security group, so response traffic for that connection is tracked.
- Check both ACL directions: the subnet ACL must permit the outbound request and the inbound response to the client’s ephemeral port.
- Inspect rule order: a lower-numbered deny overrides a higher-numbered allow.
- Use evidence: query VPC Flow Logs for the relevant interface, addresses and ports; a REJECT record narrows the investigation to network controls.
Add only the required return-port range and source scope to the applicable network ACL after verifying the actual client range. Avoid opening all traffic merely to make the symptom disappear.
SAA-C03 exam clues
Look for a security-group-to-security-group rule.
A network ACL can contain an explicit deny; a security group cannot.
Investigate stateless ACL return rules and ephemeral ports.
That scope describes the subnet’s network ACL.
The lowest numbered matching network-ACL rule is applied.
Security-group references usually provide the clearer workload control.
Common mistakes
- Assuming a security group supports deny rules.
- Forgetting that multiple security groups aggregate their allow rules.
- Opening only the service port in both NACL directions and omitting return ports.
- Reading NACL rules as a combined list instead of stopping at the first numbered match.
- Changing routes, security groups and ACLs at once without checking Flow Logs.
Questions answered
Are AWS security groups stateful?
Yes. Response traffic for an allowed connection is automatically permitted by security-group connection tracking, even when a separate rule would not allow that return direction.
Can a security group explicitly deny traffic?
No. Security groups contain allow rules. Use the absence of an allow rule for default denial, and consider a network ACL or another inspection control when an explicit network deny is required.
Why do network ACLs require ephemeral-port rules?
Network ACLs are stateless, so they evaluate request and response packets independently. A client connection normally receives its response on the client's ephemeral port, which must be allowed in the applicable return direction.
Which control should be the primary VPC access mechanism?
AWS recommends security groups as the primary network-access mechanism. Network ACLs can add coarse-grained subnet guardrails or defense in depth.