AWS Cloud Architecture•Part 2: Networking, VPC & Traffic Routing (6 - 20)
Security Groups (stateful) vs Network ACLs (stateless).
In Simple Words:
- Security Group (Stateful): Works at the instance/ENI level. If inbound traffic is allowed, outbound return traffic is automatically permitted regardless of outbound rules.
- NACL (Stateless): Works at the subnet boundary. Evaluates numbered rules in order. Outbound ephemeral return ports (1024-65535) must be explicitly allowed.
hcl
# NACL requiring explicit outbound ephemeral ports for return traffic:
resource "aws_network_acl_rule" "outbound_return" {
network_acl_id = aws_network_acl.public.id
rule_number = 100
egress = true
protocol = "tcp"
rule_action = "allow"
cidr_block = "0.0.0.0/0"
from_port = 1024
to_port = 65535
}