Security and Compliance · Topic 4 of 5
Network Security and Protection
Compare security groups, network ACLs, AWS WAF, AWS Shield and Firewall Manager for CLF-C02 and learn which layer of defence each service protects.
- 4 min
- Includes a diagram
- Security groups are stateful and work at the instance level. They have allow rules only.
- Network ACLs are stateless and work at the subnet level. They support allow and deny rules.
- Use a network ACL when you need to block a specific address explicitly.
What it is
Network security services control which traffic can reach your resources and protect applications from attacks. AWS offers several, and each works at a different point.
Some operate inside a Virtual Private Cloud (VPC, your private network in AWS). Others protect web applications or defend against distributed denial of service (DDoS) attacks, which try to overwhelm a service with traffic.
The exam asks you to match each service to its job, and to tell the two VPC firewalls apart.
How it works
Security groups and network ACLs
A security group is a virtual firewall attached to an instance or network interface. A network access control list (network ACL) is a firewall for a whole subnet.
| Feature | Security group | Network ACL |
|---|---|---|
| Applies to | Instance or network interface | Subnet |
| Rules | Allow rules only | Allow and deny rules |
| State | Stateful: replies are allowed automatically | Stateless: replies need their own rule |
| Default | Blocks inbound, allows outbound | Default one allows all traffic |
| Rule order | All rules are evaluated | Rules are processed in number order |
Stateful means the firewall remembers a connection. If you allow a request in, the reply is allowed out without another rule.
A network ACL is stateless, so you must allow return traffic yourself. Use a network ACL when you need an explicit deny, such as blocking one address range.
AWS WAF
AWS WAF (Web Application Firewall) filters web requests at the application layer. You write rules that block patterns such as Structured Query Language (SQL) injection or cross site scripting, or limit requests from one source.
It can be attached to services such as Amazon CloudFront, an Application Load Balancer and Amazon API Gateway (a service for publishing application programming interfaces).
AWS Shield
AWS Shield protects against DDoS attacks.
| Tier | Details |
|---|---|
| Shield Standard | Included automatically at no extra charge for all customers |
| Shield Advanced | Paid tier with extra protection for larger attacks, access to a response team and cost protection for attack related scaling |
Shield Standard protects against common network and transport layer attacks. Shield Advanced is for applications where an attack would be costly.
AWS Firewall Manager
AWS Firewall Manager sets up and enforces firewall rules across many accounts in AWS Organizations. It can manage AWS WAF rules, Shield Advanced protections and security groups from one place.
AWS Network Firewall
AWS Network Firewall is a managed firewall for traffic entering and leaving a VPC. Choose it when you need more detailed traffic inspection than security groups and network ACLs provide.
A layered example
!Internet traffic passes AWS Shield and AWS WAF at the edge, then the load balancer, which is the only public entry point. Web servers sit behind a security group that accepts traffic only from the load balancer, and the database sits in a private subnet whose security group accepts traffic only from the web servers. Consider a public web shop. Shield and WAF sit at the edge to stop floods and malicious requests, and the load balancer is the only public entry point.
The web servers sit behind a security group that accepts traffic only from the load balancer. The database sits in a private subnet with a security group that accepts traffic only from the web servers.
This approach is called defence in depth: several controls, so that a single mistake does not expose everything.
Other protections
- Amazon CloudFront spreads content across edge locations and absorbs some attack traffic.
- Private subnets keep resources with no public address away from the internet.
- Penetration testing of your own resources is allowed for permitted services under the AWS policy, but you must follow its rules.
What to remember for the exam
- Security groups are stateful and work at the instance level. They have allow rules only.
- Network ACLs are stateless and work at the subnet level. They support allow and deny rules.
- Use a network ACL when you need to block a specific address explicitly.
- AWS WAF protects web applications from common web exploits.
- Shield Standard is free and automatic. Shield Advanced is a paid upgrade.
- Shield defends against DDoS attacks. WAF inspects web request content.
- Firewall Manager centrally manages firewall rules across accounts.
- Network Firewall inspects traffic at the VPC level.
"Stateful" and "instance level" go with security groups. "Stateless", "subnet" and "deny rule" go with network ACLs.
Common mistakes
Trying to deny traffic with a security group. Security groups only have allow rules, so a deny needs a network ACL.
Confusing WAF with Shield. WAF filters web requests by content. Shield protects against DDoS floods.
Thinking Shield Advanced is on by default. Only Shield Standard is automatic.
Forgetting return traffic on a network ACL. Because it is stateless, replies must be permitted too.
A security group does not apply to a whole subnet. If a question asks about a subnet wide control with explicit deny, the answer is a network ACL.
Check yourself
Which VPC firewall is stateful and works at the instance level?
The security group.
Which service blocks SQL injection attempts against a web application?
AWS WAF.
Which Shield tier is included at no extra cost?
AWS Shield Standard.
Topic 4 of 5 in Security and Compliance
Test yourself on Security and Compliance
The full AWS CLF-C02 question bank has 832 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.