Security and Compliance · Topic 5 of 5
Protecting Network and Infrastructure
Layer defences with security groups, NACLs, WAF, Shield, Network Firewall and Firewall Manager, and harden EC2 and S3 with IMDSv2 and Block Public Access.
- 5 min
- Security groups are stateful and allow only, and network ACLs are stateless with allow and deny rules.
- Network ACL rules are processed in order by rule number.
- A security group can reference another security group as a source.
What it is
Defence in depth means several layers of protection, so one failure does not expose a workload. In AWS the layers run from the edge, through the VPC (Virtual Private Cloud) network, to the instance and the data store.
The exam asks which layer or service blocks a given kind of traffic, and how to reduce the attack surface of instances and buckets.
How it works
Security groups and network ACLs
| Feature | Level | State | Rules |
|---|---|---|---|
| Security group | Network interface (instance) | Stateful: return traffic is allowed automatically | Allow rules only |
| Network ACL | Subnet | Stateless: return traffic must be allowed too | Allow and deny, evaluated in number order |
Security groups deny by default and allow only what you add. A rule can name another security group as the source, which is the standard way to let a web tier reach an app tier.
Network ACLs are useful to block a specific address range, since security groups cannot deny. Because a network ACL is stateless, rules must cover the ephemeral port range used for replies.
AWS WAF
AWS WAF works at Layer 7 and filters web requests. It attaches to CloudFront, an Application Load Balancer, API Gateway and some other services. A web ACL holds rules, including AWS managed rule groups for common threats such as SQL injection and cross site scripting, and rate based rules that block a source that sends too many requests.
AWS Shield
Shield Standard protects against common network and transport layer DDoS (distributed denial of service) attacks for all customers at no extra charge. Shield Advanced is a paid option with more detection, access to the response team and cost protection for scaling during an attack. Pair it with CloudFront and Route 53 for edge absorption.
Network Firewall and Firewall Manager
AWS Network Firewall is a managed, stateful firewall for a VPC, with rules to inspect traffic by domain, protocol or pattern. It is placed in its own subnets, and route tables send traffic through it.
AWS Firewall Manager applies WAF rules, security group policies, Shield Advanced and Network Firewall policies across accounts of an organization. It also flags noncompliant resources.
| Need | Service |
|---|---|
| Block a malicious IP range at the subnet | Network ACL |
| Block SQL injection on a web app | AWS WAF |
| Limit a flood of HTTP requests from one source | WAF rate based rule |
| Stronger DDoS protection and response help | Shield Advanced |
| Inspect traffic leaving the VPC by domain name | Network Firewall |
| Enforce one policy across all accounts | Firewall Manager |
Hardening instances
- Use IAM roles on instances, not stored access keys.
- Require IMDSv2 (Instance Metadata Service version 2). It needs a session token, which defends against attacks that trick an application into fetching credentials from metadata.
- Use Session Manager instead of open SSH or RDP ports, and avoid public IP addresses on servers that do not need them.
- Keep systems patched with Patch Manager, and scan with Inspector.
- Place servers in private subnets behind load balancers.
# AWS CLI: require IMDSv2 on an instance
aws ec2 modify-instance-metadata-options \
--instance-id i-0123456789abcdef0 \
--http-tokens required --http-endpoint enabledProtecting S3
S3 Block Public Access can be set for an account or a bucket and overrides policies that would otherwise make data public. Use bucket policies for least privilege, and require TLS.
Versioning with MFA Delete and Object Lock add protection against deletion. VPC endpoints for S3 keep traffic on the AWS network, and a bucket policy can restrict access to a given endpoint.
Reducing exposure
Remove unused security group rules, avoid 0.0.0.0/0 for administrative ports, and use AWS Config rules to flag open ports or public resources. Use managed prefix lists to keep address lists in one place.
To block one IP address range, use a network ACL deny rule. A security group cannot deny, so it is not the answer.
What to remember for the exam
- Security groups are stateful and allow only, and network ACLs are stateless with allow and deny rules.
- Network ACL rules are processed in order by rule number.
- A security group can reference another security group as a source.
- AWS WAF filters web requests at Layer 7 and supports managed and rate based rules.
- Shield Standard is automatic and free, and Shield Advanced is paid with extra support.
- Network Firewall inspects VPC traffic, and Firewall Manager sets policy across accounts.
- IMDSv2 requires a token, and
--http-tokens requiredenforces it. - S3 Block Public Access overrides permissive policies and ACLs.
- Use roles and Session Manager rather than keys and open ports.
Common mistakes
Using a security group to deny an address. Security groups only allow. Use a network ACL or WAF.
Forgetting ephemeral ports in a network ACL. Replies are dropped because the stateless rules do not allow them.
Opening port 22 to the world. Use Session Manager or restrict the source.
Putting WAF on a Network Load Balancer. WAF attaches to supported Layer 7 services, not to an NLB.
Leaving IMDSv1 enabled. It is easier for an attacker to abuse through a server side request forgery flaw.
Changing a network ACL affects every instance in the subnet at once. A wrong deny rule can cut off the whole subnet, so change rules with care.
Check yourself
Try these questions.
Which feature blocks SQL injection on an Application Load Balancer?
AWS WAF with a managed rule group on a web ACL attached to the load balancer.
Why must a network ACL allow ephemeral ports?
Network ACLs are stateless, so reply traffic is not allowed automatically.
How do you stop credentials being fetched through a metadata attack?
Require IMDSv2 on the instance, which needs a session token.
Topic 5 of 5 in Security and Compliance
Test yourself on Security and Compliance
The full AWS SOA-C03 question bank has 850 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.