network ACLs
- What they are
- Network Access Control Lists — firewalls at the subnet level inside a VPC.
- Apply to every resource in the subnet automatically.
- The defining properties
- Stateless — return traffic is not automatically allowed. You must write both an inbound and an outbound rule (remember ephemeral ports 1024–65535 for responses).
- Support both allow and deny rules — the only way to block a specific IP address in a VPC.
- Rules are numbered and evaluated in order, lowest first; the first match wins and evaluation stops.
- One NACL per subnet, but one NACL can serve many subnets.
- Defaults
- The default NACL allows all inbound and outbound traffic. A custom NACL denies everything until you add rules.
- Contrast with security groups
- NACL = subnet, stateless, allow + deny, ordered rules.
- Security group = instance, stateful, allow only, all rules evaluated.
- Exam signal
- “Block a specific malicious IP address” → network ACL, because security groups cannot deny.