What is network ACL vs security group?
In a Virtual Private Cloud (VPC), you have two distinct layers of defense to protect your resources. While both act as firewalls, they work at different levels of the "networking stack."
Think of Security Groups as the bouncer at the club door, while Network ACLs (NACLs) are the security guards at the gated community's perimeter.
| Feature | Security Group (SG) | Network ACL (NACL) |
| Layer of Operation | Instance Level (Virtual Machine) | Subnet Level (The whole neighborhood) |
| Type | Stateful | Stateless |
| Rules | Supports "Allow" rules only | Supports "Allow" and "Deny" rules |
| Evaluation | All rules are evaluated before traffic is allowed | Rules are processed in numerical order |
| Default | Denies everything until you allow it | Allows everything until you deny it (usually) |
A Security Group sits right in front of your individual server (instance).
Stateful Memory: This is the most important feature. If you send a request out from your server, the Security Group "remembers" it and automatically lets the response come back in, regardless of your inbound rules.
Targeted Protection: You can have one Security Group for your Web Servers (allowing Port 80/443) and a different one for your Database (allowing only Port 3306 from the Web Group).
A Network ACL is a secondary layer of security that controls traffic entering or leaving an entire subnet.
Stateless Nature: Unlike the Security Group, the NACL is "forgetful." If you allow traffic in, you must also explicitly write a rule to allow it out. It does not track the "state" of a connection.
The Power of "Deny": This is the NACL’s superpower. Security Groups can’t say "No"; they can only say "Yes" to specific things. If you want to block a specific malicious IP address from your entire network, you do it in the NACL.
Rule Order: Rules are processed by number (e.g., Rule 100, Rule 200). As soon as a packet matches a rule, it stops looking at the rest.
The Network ACL (NACL): This is the Security Gate at the entrance to the office park. They check every car coming in and every car going out. If your name is on the "Banned" list, you don't even get to the parking lot.
The Security Group: This is the Keycard Reader on your specific office door. Even if you made it through the front gate, you can’t get into this room unless you have the specific permission for it. Because it's "stateful," if you walk out of the room to get a coffee, the door stays unlocked for you to walk back in.
In a well-architected cloud environment, you use both.
Use Security Groups for 95% of your work. They are easier to manage because they are stateful and allow you to "link" groups together (e.g., "Allow my Web Group to talk to my DB Group").
Use Network ACLs as a "Broad Brush." Use them to block specific bad actors (IP blacklisting) or as a backup "failsafe" to ensure no one accidentally opens a dangerous port on a Security Group.
Security Groups are your specific, smart defense, while NACLs are your broad, blunt defense. By layering them together, you create "Defense in Depth," ensuring that even if a developer makes a mistake on an individual server's settings, the network perimeter still holds.