AWS Certified Advanced Networking - Specialty Exam Guide

Controlling access

Combining NACLs and security groups gives us complete control of the application. We have the ability to both statelessly control traffic at the edge of the network as well as statefully control access at the perimeter of the elastic network adapter. This gives us a lot of flexibility in regards to what kind of traffic we allow into our instances.

For example, when we need to block malicious traffic from a certain IP address range, we can quickly and easily enter that address range into the NACL, which allows all traffic by default. On the other hand, when we want to only allow access from one very specific IP address, we can enter that IP into a rule on a security group, which is designed to deny all and only allow the ...