What's changed: In-scope coverage: added identity (Cognito/Directory Service/IAM Identity Center), keys/certs (CloudHSM/ACM), threat detection (GuardDuty/Inspector/Macie/Detective/Security Hub), network defense (Network Firewall/Firewall Manager), and compliance (Artifact/Audit Manager) across sections
1.3VPC and Network Security
Understand VPCs and subnets (public/private), the difference between security groups and network ACLs, and network defenses like WAF/Shield.
A VPC is your private network on AWS. Separating public subnets (internet-facing) and private subnets (e.g., DBs) and controlling traffic is fundamental to secure design.
1.3.1Security groups and network ACLs
- Security groups: at the instance (ENI) level; stateful (auto-allow return traffic), allow rules only.
- Network ACL (NACL): at the subnet level; stateless (return traffic needs explicit rules), supports both allow and deny.
- Connectivity: internet gateway (IGW) for public subnets; NAT gateway lets private subnets reach out (outbound only).
- WAF (L7 app protection), Shield (DDoS), and VPC endpoints (reach AWS services privately) add further defense.
| Aspect | Security group | Network ACL |
|---|---|---|
| Level | Instance (ENI) | Subnet |
| State | Stateful | Stateless |
| Rules | Allow only | Allow + deny |
| Return traffic | Auto-allowed | Needs explicit rule |
A standard VPC design: put internet-facing tiers (ALB, bastion) in public subnets and apps and DBs in private subnets, restricting traffic per tier with security groups. When private instances need outbound access (e.g., patching), route them through a NAT gateway (no inbound). Security groups and NACLs are used together for defense in depth, but do fine-grained control mainly with security groups and use NACLs for coarse subnet-wide blocks (e.g., deny a specific IP). For S3 or DynamoDB, VPC endpoints connect privately without traversing the internet—secure and lower-cost.
Scenario: a 3-tier architecture. The ALB sits in a public subnet; app EC2 and RDS in private subnets. Security groups minimize traffic ("ALB→app on 443, app→RDS on 3306 only, referencing each SG as source"). App outbound patching goes via a NAT gateway. S3 access uses a VPC endpoint, avoiding the internet. Never place the DB in a public subnet.
Watch the mix-ups: (1) security group = instance/stateful/allow-only vs NACL = subnet/stateless/allow+deny. (2) IGW (public gateway) vs NAT gateway (outbound-only for private). (3) Keep DBs in private subnets. (4) Use VPC endpoints to reach AWS services privately.
Q. Security group or NACL for control? Usually security groups (stateful, easier); NACLs for coarse subnet-wide blocks—use both for defense in depth. Q. IGW vs NAT? IGW is the bidirectional gateway for public subnets; NAT allows only outbound from private subnets. Q. Benefit of VPC endpoints? Reach AWS services without the internet—secure and lower-cost.
Common on SAA: security group = instance/stateful/allow-only, NACL = subnet/stateless/allow+deny, DBs in private subnets, outbound from private = NAT gateway, private access to AWS services = VPC endpoints.
1.3.2Other key in-scope services (threat detection, network defense, compliance)
Beyond network controls, know the managed services for threat detection and investigation. Amazon GuardDuty continuously detects malicious or anomalous behavior by analyzing logs (just enable it). Amazon Inspector automatically scans EC2/containers/Lambda for vulnerabilities. Amazon Macie discovers and classifies sensitive data such as PII in S3. Amazon Detective investigates root cause by correlating logs from findings. AWS Security Hub centralizes and prioritizes findings across these. For network defense, AWS Network Firewall provides a stateful managed firewall for the VPC, and AWS Firewall Manager centrally manages firewall rules (WAF/Network Firewall/security groups) across the organization.
For compliance evidence, AWS Artifact lets you download AWS compliance reports (SOC/ISO, etc.) on demand—use it when you need third-party attestations for auditors. AWS Audit Manager automates collecting evidence of control compliance—choose it to reduce the effort of producing audit reports.
| What you want | Service |
|---|---|
| Continuous threat detection | Amazon GuardDuty |
| Vulnerability scanning | Amazon Inspector |
| Sensitive-data discovery in S3 | Amazon Macie |
| Investigate root cause | Amazon Detective |
| Aggregate/prioritize findings | AWS Security Hub |
| Stateful managed VPC firewall | AWS Network Firewall |
| Central firewall-rule management | AWS Firewall Manager |
| Download compliance reports | AWS Artifact |
| Automate audit evidence | AWS Audit Manager |
1.3.3Section summary
- Separate public/private subnets (DBs private); outbound via NAT, gateway via IGW
- Security groups (instance/stateful/allow-only) / NACL (subnet/stateless/allow+deny)
- Reach AWS services via VPC endpoints; WAF for L7, Shield for DDoS
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Which correctly describes a security group?
Q2. Which operates at the subnet level and supports both allow and deny rules?
Q3. Where is it most secure to place a database?