1.2 VPC Security Groups, Network ACLs, WAF & Shield

🎯 Key AWS SAA-C03 Architectural Takeaways

• Security Groups are stateful packet filters operating at the instance/ENI layer; outbound return traffic is automatically permitted regardless of outbound rules.
• Network ACLs (NACLs) are stateless packet filters at the subnet layer; inbound client requests on port 80/443 require outbound NACL rules allowing ephemeral ports 1024-65535 for return traffic.
• AWS WAF operates at Layer 7 on CloudFront, ALB, or API Gateway to inspect HTTP payloads for SQL injection (SQLi), Cross-Site Scripting (XSS), and mitigate HTTP floods via rate-based rules.
• AWS Shield Standard is enabled automatically at no cost for all AWS customers; AWS Shield Advanced adds 24/7 Shield Response Team (SRT) access, Layer 3/4/7 protection, and DDoS cost spike protection.

Amazon VPC provides two native packet filtering layers: Security Groups and Network Access Control Lists (NACLs). Security Groups are attached to Elastic Network Interfaces (ENIs) and operate at Layer 4. Because Security Groups are stateful, any connection allowed inbound automatically allows return traffic outbound, regardless of outbound rule settings. Security Groups evaluate all rules before deciding to allow traffic and do not support explicit Deny rules.

Network ACLs provide a secondary perimeter boundary at the subnet level. NACLs are stateless: every inbound and outbound packet is evaluated independently. Furthermore, NACL rules are processed in numerical order from lowest to highest, stopping at the first match. When clients connect to web servers on port 443, client operating systems select a random ephemeral source port (ports 1024-65535). An outbound NACL rule must explicitly permit destination ports 1024-65535 to allow response packets to leave the subnet.

At the application layer, AWS WAF protects web applications against common web exploits. By associating WAF with an Amazon CloudFront distribution or Application Load Balancer, architects deploy AWS Managed Rules (such as Core Rule Set and SQL database rules) to block SQL injection and cross-site scripting attacks. Rate-based rules track requests per IP over sliding evaluation windows, automatically throttling brute-force login and credential stuffing attacks.

AWS Shield provides perimeter defense against Distributed Denial of Service (DDoS) attacks. Shield Standard automatically defends all AWS infrastructure against SYN floods, UDP reflection attacks, and Layer 3/4 attacks at no extra charge. Shield Advanced offers dedicated DDoS mitigation support from the AWS Shield Response Team (SRT), custom WAF rule automation, and financial protection against scaling cost spikes caused by DDoS attacks.

⚠️ Common Pearson VUE / AWS Exam Traps

• Attempting to write Deny rules in Security Groups — Security Groups only support Allow rules; all unlisted traffic is denied by default.
• Forgetting outbound ephemeral ports on stateless Network ACLs, causing outbound HTTP/HTTPS replies to be dropped.
• Expecting AWS WAF to inspect raw TCP or UDP packets — WAF operates strictly on Layer 7 HTTP/HTTPS web application traffic.