NACLs
The second layer of defense is our NACLs. NACLs allow or deny traffic that's coming in or out of the subnet, and are defined as stateless rules that work in exactly one direction. An ACL can be used to define strict rules on network access and provide protection at the network level. The NACLs reside at the entry point to the subnet, and each subnet has a default NACL that is modifiable and can be used to control the traffic when it goes in and out. We can also create additional NACLs, but a subnet in a VPC can only be assigned to one NACL at a time.
NACLs protect subnets within our VPCs in a very similar way to how security groups protect instances. Unlike security groups, NACLs allow all traffic between subnets and gateways by default, ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access