5.2
Security Groups vs NACL
Security groups are stateful at the ENI; NACLs are stateless at the subnet.
Key points
- Security Group → stateful.
- NACL → stateless; inbound and outbound evaluated separately.
Security Group
- Stateful
- Provides resource-level network control
- Commonly associated with EC2 network interfaces
Network ACL
- Stateless
- Provides subnet-level network control
- Inbound and outbound rules are evaluated separately
Exam trick
- Security Group → Stateful
- NACL → Stateless
Exam focus
Stateful vs stateless is the exam split.