What's changed: Added figure aws-genai-security (OWASP LLM risks → AWS mitigations) to the gen-AI security section s4. The cloned base chapters inherit SCS-C02 figures; s4 was the only section lacking one, now filled.
3.1Protecting the Network Perimeter
Understand VPC security—security groups/NACLs, subnet isolation, NAT/IGW, VPC endpoints (Gateway/Interface), and PrivateLink. Defend networks in depth.
Network perimeter is the basis of infrastructure defense. Defend in layers (SG/NACL/subnet) and avoid unnecessary exposure.
3.1.1Layered network defense
- Security groups: per-instance, stateful, allow-only (no deny rules).
- NACL: per-subnet, stateless, allow/deny; can explicitly deny.
- Subnet isolation/NAT: public for exposed, private for internal; egress-only via a NAT gateway.
- VPC endpoints: reach AWS services without the internet (S3/DDB = gateway, others = interface/PrivateLink).
Common on SCS-C02: per-instance, stateful, allow-only = security groups, per-subnet, stateless, can-deny = NACL, egress-only = NAT gateway, private access to AWS services = VPC endpoints (S3/DDB = gateway type). Use NACLs to explicitly deny IPs; SGs for normal allow.
Security groups auto-allow return traffic (stateful). NACLs are stateless, so you must also allow ephemeral ports for return traffic.
SCS-C02 network defense probes "precisely distinguishing SG vs NACL and shrinking attack surface in layers." A security group (SG) is a stateful virtual firewall per instance (ENI), allow-only (implicit deny; no explicit deny). You can set another SG as the source (e.g., allow the web tier only from the ALB’s SG), cleanly expressing inter-tier communication. A NACL is stateless control per subnet evaluating allow and deny in number order—needed for blocking specific IPs or allowing ephemeral ports for return traffic. Split subnets into public (exposed via IGW) / private (egress via NAT, internal only), placing the data tier in internet-unreachable private subnets. Reach AWS services via VPC endpoints without the internet, distinguishing gateway type (S3/DynamoDB, free, route table) from interface type (ENI, PrivateLink, many services), and restrict access with endpoint policies. Further connect via VPC peering/Transit Gateway, and visualize traffic with flow logs. The key is to not confuse "stateful, allow-only, per-instance = SG / stateless, can-deny, per-subnet = NACL," and to defend in depth with private connectivity and minimal exposure.
| Aspect | Security group | NACL |
|---|---|---|
| Scope | Per instance (ENI) | Per subnet |
| State | Stateful (auto-allow return) | Stateless (explicit return) |
| Rules | Allow-only | Allow/deny (numbered) |
| Typical use | Inter-tier allow; SG as source | Explicitly deny specific IPs |
Scenario: In a 3-tier (web/app/DB) setup, allow web only from the ALB, app only from web, DB only from app, and fully block a specific attacker IP range. → Set each tier’s SG source to the upstream SG for least-privilege inter-tier access (the DB SG allows only the DB port from the app SG). Put the DB in an internet-unreachable private subnet. Block the attacker IP range with an explicit deny in the subnet NACL (SGs cannot deny). Reach AWS services via VPC endpoints.
FAQ: SG or NACL to block a specific IP? NACL. SGs are allow-only and cannot explicitly deny (deny = not allowing). To explicitly block a specific malicious IP/range, use a NACL deny rule per subnet. Do normal inter-tier allows with SGs (SG as source), combining both for layered defense.
Exam trap: Trying to create a "deny specific IP" rule in an SG is wrong—SGs are allow-only with no deny rules. Explicit deny is via NACL. Also, NACLs are stateless, so allowing inbound without separately allowing the return (outbound ephemeral ports) breaks the connection (SGs are stateful and auto-allow).
3.1.2Section summary
- Layered = SG (instance/allow-only) + NACL (subnet/can-deny)
- Private access = VPC endpoints/PrivateLink / egress = NAT
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. Explicitly deny traffic from a malicious IP range at the subnet level. What?
Q2. Connect from EC2 to S3 privately without traversing the internet. What?
Q3. Which statement about security groups is correct?