Without network security controls, anyone on the internet could walk directly into your cloud resources, read your databases, or launch attacks from inside your virtual network. This chapter teaches you how to build layered barriers — security groups, network ACLs, AWS WAF, and network firewalls — that protect your AWS environment from unauthorised access, malicious traffic, and data breaches. For the AWS Certified Advanced Networking Specialty exam, you need to know exactly when to use each tool and how they interact.
Jump to a section
A simple way to picture Network Security and Access Control
A busy embassy on a city street, with a queue of visitors waiting outside the main gate.
First, a guard at the street-level barrier checks every visitor's ID against a list of approved names written on a clipboard. This is the network ACL — a stateless filter that checks traffic before it even reaches the building, looking only at source and destination addresses, not caring about the conversation history. Visitors whose names are not on the list are turned away immediately.
Inside the lobby, a second guard sits behind a desk and decides which rooms each approved visitor may enter. This guard is a security group — stateful, meaning he remembers if you just came from the conference room and lets you go back to the front desk without re-checking your badge. He also logs every door you open and every corridor you walk down.
Above the reception desk, a glass screen monitors all conversations happening in the building. It can detect if someone is trying to say a coded phrase or shout a password too loudly. That screen is AWS WAF — it inspects the actual content of the traffic, blocking malicious requests like SQL injections or cross-site scripting.
Outside, at the perimeter of the embassy compound, a heavy steel barrier can block entire trucks or slow down suspicious vehicles. This is the network firewall — a dedicated appliance or service that performs deep packet inspection, intrusion prevention, and protocol-level filtering. Together, these four layers create a defence-in-depth: even if one layer fails, the next one still protects the building.
Network security and access control in AWS is about deciding who and what can communicate with your resources. Think of your Virtual Private Cloud (VPC) as a private office building inside the AWS cloud. You need multiple layers of security because no single tool can stop everything.
Security Groups act as virtual firewalls for your EC2 instances (virtual servers) and other resources. They are stateful, which means if you allow incoming traffic on port 80 (HTTP), the return traffic is automatically allowed — you don't need a separate outbound rule. Security groups only have 'allow' rules, never 'deny' rules by default. Everything is denied unless a rule explicitly permits it. You attach them to resources, not to subnets. For example, you might create a security group that allows SSH (Secure Shell, port 22) only from your office IP address, and HTTP (port 80) from anywhere.
Network Access Control Lists (NACLs) are stateless firewalls that operate at the subnet level. Unlike security groups, NACLs have both allow and deny rules. Because they are stateless, you must explicitly allow both inbound and outbound traffic separately. If you allow incoming HTTP traffic, you also need an outbound rule to permit the response traffic. NACLs process rules in order by their rule number, from lowest to highest, and stop processing after the first matching rule. This is useful for blocking specific IP addresses at the subnet boundary, such as denying traffic from a known malicious range.
AWS WAF (Web Application Firewall) protects your web applications from common web exploits. It sits in front of services like CloudFront (AWS's content delivery network), Application Load Balancers (ALBs), or API Gateway. WAF inspects the actual content of HTTP/S requests — headers, body, query strings — and can block, allow, or count traffic based on conditions you define. For example, you can create rules to block SQL injection attempts by looking for patterns like ' OR 1=1 in query strings, or to block cross-site scripting (XSS) by detecting script tags in form inputs. You can also use rate-based rules to block IP addresses that send too many requests in a short period, which helps stop DDoS attacks.
AWS Network Firewall is a managed firewall service that gives you granular control over VPC-to-VPC and VPC-to-internet traffic. It performs stateful inspection, meaning it understands the context of traffic flows, not just individual packets. It can filter based on domain names, protocol types, and even inspect traffic for known malware signatures using intrusion prevention system (IPS) capabilities. Network Firewall sits in a dedicated subnet in your VPC and routes traffic through it using a route table. This is useful for organisations that need to enforce compliance policies, such as blocking all traffic to known malicious IP addresses or preventing data exfiltration to unapproved cloud storage services.
These four tools work together in layers. The network firewall inspects traffic at the VPC edge. The NACL filters traffic entering and leaving each subnet. The security group controls traffic to individual resources. And WAF protects the application layer. This is called defence in depth — if one layer misses something, another layer catches it.
Why does AWS offer so many overlapping tools? Each one solves a different problem at a different level of the network stack. Security groups are simple and perfect for per-instance controls. NACLs give you stateless, number-based filtering for subnets. WAF handles web-specific threats. Network Firewall gives enterprise-grade stateful inspection. Using the right tool for the right job is a key skill for the ANS-C01 exam.
Analyse requirements
Identify what you need to protect: which resources (EC2, ALB, database), what threat types (web attacks, IP blocks, malware), and compliance rules (PCI DSS, GDPR). This determines which tools to use.
Design security groups
Create security groups for each tier of your application. Use least-privilege rules: allow only the specific ports and source IPs or source security groups needed. Attach the security group to each resource's Elastic Network Interface (ENI).
Configure Network ACLs
Create custom NACLs for each subnet. Add inbound and outbound rules in order of specificity (more specific rules at lower numbers). Remember to allow ephemeral ports (1024-65535) for response traffic. Deny known bad IPs first.
Deploy AWS WAF
Choose the web-facing resource (ALB, CloudFront, or API Gateway). Create a WAF web ACL with managed rule groups for common attacks. Add custom rules for rate limiting and IP reputation lists. Associate the ACL with the resource.
Set up Network Firewall
Create a dedicated firewall subnet in your VPC. Configure a Network Firewall endpoint and update route tables to route traffic through it. Define stateful rule groups for domain filtering and IPS. Deploy and test that traffic flows as expected.
Test and monitor
Use VPC Flow Logs to verify traffic patterns. Check security group and NACL logs for denied traffic. Test your WAF rules by sending sample attacks (e.g., a simple SQL injection in a query string). Monitor Network Firewall alerts in Amazon CloudWatch.
Suppose you work for a company called FinSecure that runs a banking application on AWS. Your application has three tiers: a web server tier, an application server tier, and a database tier. Each tier runs on EC2 instances inside a VPC. You need to secure the traffic between these tiers and from the internet.
Step by step, here is what an IT professional would do:
First, design the network architecture. The web servers go in a public subnet, the app servers in a private subnet, and the database servers in another private subnet. An internet gateway (IGW) is attached to the VPC to allow inbound traffic from the internet. A NAT gateway (Network Address Translation) is placed in the public subnet so private instances can download updates without being directly reachable. - Create security groups. The web server security group allows inbound HTTP (port 80) and HTTPS (port 443) from 0.0.0.0/0 (anywhere). The app server security group allows inbound traffic only from the web server security group's ID on port 8080 (the application port). The database security group allows inbound MySQL (port 3306) only from the app server security group's ID. This ensures that only the web servers can talk to the app servers, and only the app servers can talk to the database. - Configure network ACLs. The public subnet NACL allows inbound HTTP/HTTPS from anywhere and outbound ephemeral ports (1024-65535) for the response traffic. The private subnet NACLs deny all inbound traffic from outside the VPC and allow only internal traffic. Each NACL rule is numbered, and you leave gaps between numbers (e.g., 100, 200, 300) so you can insert rules later. - Deploy AWS WAF. You attach it to the Application Load Balancer in front of the web servers. You create a managed rule group from the AWS Managed Rules for SQL injection and XSS. You also create a custom rate-based rule that blocks any IP making more than 2000 requests in five minutes. This protects against both application-layer attacks and scraping bots. - Set up AWS Network Firewall. You create a firewall subnet in the VPC and update the route tables so that all traffic between subnets and to the internet is routed through the firewall. You configure stateful rule groups to allow only known good domains for software updates (like repo.aws.amazon.com) and block all traffic to known malware domains using the threat intelligence feeds provided by AWS. You also enable intrusion prevention to alert and block any traffic that matches known exploit patterns.
After deployment, the IT team monitors everything using VPC Flow Logs (logs of all network traffic) and Amazon Detective to analyse any anomalies. If the compliance team asks for a report, the engineer can show that all tiers are segmented, web traffic is inspected for attacks, and outbound traffic is strictly controlled. This setup meets PCI DSS requirements for cardholder data environments.
When something goes wrong — say, a developer complains they cannot SSH into an app server — the engineer first checks the security group rules, then the NACL, then the Network Firewall logs to find which layer is blocking the traffic. This layered approach makes troubleshooting systematic rather than chaotic.
The ANS-C01 exam tests your ability to differentiate between security groups, NACLs, WAF, and Network Firewall, and to know when to use each one. Expect scenario-based questions where you must choose the correct combination of tools for a given requirement.
Key exam topics:
Stateful vs stateless: Security groups are stateful (automatically allow return traffic). NACLs are stateless (require explicit outbound rules). This is the most tested distinction. A common trap question: 'A user allows inbound HTTP traffic on a security group. Does outbound traffic for the response need a separate rule?' Answer: No, because security groups are stateful.
Rule evaluation order: NACLs evaluate rules in ascending order by rule number. Once a rule matches, processing stops. Security groups evaluate all rules and allow traffic if any rule permits it. If no rule matches, traffic is denied.
Default NACL vs custom NACL: A default NACL allows all inbound and outbound traffic. A custom NACL denies all inbound and outbound traffic by default. The exam expects you to know this and to recognise that creating a custom NACL without adding rules will block all traffic.
Security group referencing: You can use another security group as the source in a rule, not just CIDR blocks. For example, allow inbound from SG-web to SG-app. This makes management dynamic. The exam loves testing this.
WAF rule types: Know the difference between a rate-based rule (limits requests per IP per five minutes) and a regular rule (conditions like SQL injection match). Understand how rule groups work.
Network Firewall features: Stateful inspection, domain filtering, IPS, and TLS inspection (decrypting HTTPS traffic to inspect it). The exam may ask what to use when you need to block traffic by domain name — answer is Network Firewall.
Service integration: WAF works with CloudFront, ALB, API Gateway, and AppSync. Network Firewall works with VPCs. Security groups attach to ENIs (Elastic Network Interfaces). NACLs attach to subnets. Memorise which tool integrates with which AWS service.
Common traps:
A question asks for a 'stateful firewall at the subnet level'. The trap is thinking of NACL, but NACLs are stateless. The right answer is that no such AWS-native service exists at the subnet level; security groups are stateful but at the instance level. For stateful subnet filtering, you would use Network Firewall.
A question about 'blocking an IP address at the VPC edge' may trick you into using a security group (which does not have deny rules). The correct answer is NACL with a deny rule, or Network Firewall.
The exam may describe a scenario where a company needs to block SQL injection attacks on an API Gateway endpoint. The correct answer is WAF, not a security group, because WAF inspects application-layer content.
Memorise these definitions:
Stateless: Does not remember previous packets. Each packet is evaluated independently.
Stateful: Remembers the state of connections. If a packet is part of an established session, it is automatically allowed.
Network ACL: Subnet-level, stateless, supports allow and deny, rule-number-ordered.
Security group: Instance-level, stateful, allow-only (implicit deny), all rules evaluated.
WAF: Web application layer, content inspection, rate-based rules.
Network Firewall: VPC-level, stateful, IPS, domain filtering.
Security groups are stateful and allow-only, while Network ACLs are stateless and support both allow and deny rules.
AWS WAF inspects HTTP/S request content (Layer 7) and can block SQL injection, XSS, and rate-limit IP addresses.
Network Firewall provides stateful inspection at the VPC level including domain filtering and intrusion prevention.
NACLs evaluate rules in ascending order by rule number and stop at the first match; security groups evaluate all rules.
Default NACLs allow all traffic; custom NACLs deny all traffic by default.
Security group rules can reference other security groups as source or destination, enabling dynamic and scalable rule management.
WAF integrates with CloudFront, ALB, API Gateway, and AppSync — but not directly with EC2 instances.
For defence in depth, use security groups, NACLs, WAF, and Network Firewall together, as no single tool blocks all threat types.
These come up on the exam all the time. Here's how to tell them apart.
Security Group
Stateful — automatically allows return traffic
Operates at the instance/ENI level
Only supports allow rules (implicit deny)
Network ACL
Stateless — requires explicit outbound rules for return traffic
Operates at the subnet level
Supports both allow and deny rules
AWS WAF
Layer 7 (application layer) only — inspects HTTP/S content
Integrates with CloudFront, ALB, API Gateway, AppSync
Protects against web application attacks (SQLi, XSS)
AWS Network Firewall
Layers 3-7 — inspects all IP traffic across protocols
Deployed inside a VPC, requires custom route tables
Provides intrusion prevention and domain filtering
Default NACL
Allows all inbound and outbound traffic by default
Cannot be deleted, only modified
Associated with a VPC's default subnet automatically
Custom NACL
Denies all inbound and outbound traffic by default
Must be explicitly associated with subnets
Requires manual rule creation to allow traffic
Stateful Firewall (Security Group)
Remembers connection state — return traffic auto-allowed
Simpler to configure for most use cases
Cannot block specific IPs with deny rules
Stateless Firewall (NACL)
Each packet evaluated independently
Requires careful outbound rule management
Can explicitly deny traffic from specific sources
Mistake
Security groups have deny rules that I can use to block specific IP addresses.
Correct
Security groups only have allow rules. To block a specific IP address, you must either not include it in an allow rule or use a Network ACL with a deny rule.
Many beginners come from on-premises firewall experience where deny rules are common. AWS security groups are intentionally designed as an allow-list model to simplify configuration and reduce misconfiguration risk.
Mistake
Network ACLs are stateful, so I only need to define inbound rules.
Correct
Network ACLs are stateless. You must define both inbound and outbound rules separately, including rules for response traffic on ephemeral ports.
The term 'access control list' sounds similar to on-premises ACLs which can be stateful in some contexts. AWS documentation clearly states NACLs are stateless, but this gets overlooked under exam pressure.
Mistake
AWS WAF and Network Firewall do the same thing, so I can use either one in any scenario.
Correct
WAF operates at Layer 7 (application layer) and inspects HTTP/S content. Network Firewall operates at Layers 3-7 but provides deep packet inspection, IPS, and domain filtering at the network level. They are complementary, not interchangeable.
Both services use the word 'firewall', and beginners assume they are redundant. In reality, WAF is for web application attacks, while Network Firewall is for network-level traffic control and threat prevention.
Mistake
If I allow all traffic in a security group, I don't need a Network ACL.
Correct
Security groups and NACLs are independent layers. Even if a security group is permissive, a NACL that denies traffic will still block it. Both must be configured correctly for traffic to flow.
Beginners think of security groups as the only firewall and forget that NACLs are an additional barrier. Exam questions often test this layered relationship.
Mistake
AWS Network Firewall is automatically deployed in my VPC, I just need to enable it.
Correct
Network Firewall requires you to create a firewall subnet, update route tables to route traffic through it, and configure rule groups. It is not a simple toggle.
AWS offers many services that are easy to enable (like VPC Flow Logs). Network Firewall requires careful network design, and the exam tests whether you understand the setup process.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No, security groups only support allow rules. To block a specific IP address, use a Network ACL with a deny rule for that IP, or use AWS Network Firewall with a stateful deny rule.
Security groups are stateful and operate at the instance/ENI level with only allow rules. NACLs are stateless, operate at the subnet level, support both allow and deny rules, and are evaluated in order by rule number.
Not for basic setups, but using both adds defence in depth. NACLs can block traffic at the subnet boundary before it reaches the security group. For the exam, know that both layers exist and can be used together.
Use WAF when you need to inspect the content of HTTP/S requests (like blocking SQL injection or XSS). Use Network Firewall when you need network-level controls like domain filtering, IP blocking, or intrusion prevention across all protocols, not just HTTP.
No, WAF must be associated with an Application Load Balancer, CloudFront distribution, API Gateway, or AppSync API. To protect EC2 instances, you typically place them behind an ALB and attach WAF to the ALB.
A rate-based rule counts requests from a single IP address over a five-minute window. If the count exceeds your threshold (e.g., 2000 requests), WAF blocks further requests from that IP for a specified time. It helps prevent DDoS attacks.
You've finished Network Security and Access Control. Continue through the ANS-C01 study guide to build a complete picture of the exam.
Done with this chapter?