Security Groups Flashcards
How do security groups behave by default?
- Do not allow any inbound traffic
- Allow all types of outbound traffic
Security Groups
Operate at the instance layer
Firewalls for the instance
Control inbound and outbound traffic
If an AWS service involves instances, it also supports security groups
What is a security group composed of?
- Traffic type (ssh, rdp)
- Internet protocol (tcp or udp)
- Port range
- Origin of traffic for inbound rules
- Destination of traffic for outbound rules
How are origins and destinations defined?
IP address, IP address range, or security group ID
How do security group rules work?
- You can only create rules that allow traffic to pass in
- Traffic parameters that do not match any security group rules are automatically denied
Are security group rules stateless?
No. Stateful. If you send a request from your instance, response traffic for that request is allowed to flow in regardless of inbound rules
- Responses to allowed inbound traffic are allowed to flow out regardless of outbound rules
What IP address should you use for rules between VPC instances?
Private IP, not public IP or elastic IP
What are security groups associated with?
Network interfaces, not the instances themselves
What are security groups bound to?
- Network interfaces and security groups are bound to the VPC they are launched in so they cannot be used for other VPCs
- Security groups belonging to a different VPC can be referenced as the origin or destination of a rule for a peered VPC
What level do ACLs operate in?
Subnet layer
What do ACL rules consist of?
Rule number, traffic type, protocol, port range, source for inbound, destination for outbound, and allow or deny setting
What’s the significance of rule numbering?
Rules are evaluated starting with the lowest rule number. As soon as a rule matches, it’s applied regardless of any higher number rules that might contradict it
NACL
Network Access Control Lists
What happens if no rule matches?
Traffic is denied
Are NACLs stateless?
Yes, they are stateless. Sources and destinations need to be allowed on both inbound and outbound
What’s the default behavior of a NACL?
Every VPC comes with a default NACL which allows all inbound and outbound traffic
What’s the default behavior of a custom NACL?
Denies all inbound and outbound traffic until you add rules
Can a subnet be associated with multiple ACLs?
No, but an ACL can be associated with multiple subnets
