Security Groups vs NACLs
In AWS, how do security groups differ from network ACLs?
Answers use simple, clear English.
Audio N/AQuick interview answer
Security groups are stateful allow-rules attached to ENIs/instances (return traffic automatic). NACLs are stateless subnet-level allow/deny evaluated in order. Prefer security groups for most app controls; use NACLs sparingly for coarse subnet guardrails.
Detailed answer
Security groups are stateful allow-rules attached to ENIs/instances (return traffic automatic). NACLs are stateless subnet-level allow/deny evaluated in order. Prefer security groups for most app controls; use NACLs sparingly for coarse subnet guardrails. Azure NSGs are closer to security-group style controls.
Full explanation
Azure NSGs are closer to security-group style controls.
Real example & use case
Allow app SG to receive 443 from ALB SG only; deny all else.
Pros & cons
Pros of SG: simpler stateful model. Cons: very large SG rule sets become hard to reason about — split by tier.