AWS VPC : Basics Of VPC Network Security

Welcome to the essential guide on securing your AWS network. Before you can build complex applications, you must first build a secure foundation. In AWS, that foundation is your Virtual Private Cloud (VPC). For any security professional, mastering the fundamental controls of a VPC isn't just a recommendation—it's the bedrock of your entire cloud security posture.

This guide will demystify the core components you'll use every day to control traffic and keep your private resources private, providing the critical knowledge you need for the AWS Security Specialty exam and your daily work.

Part 1: Your VPC's Two Firewalls - A Tale of Two Guards

Every VPC comes equipped with two primary firewall services. They may seem similar, but their roles are distinct and complementary. Understanding when to use each is crucial.

Analogy: Imagine your VPC is a private neighborhood. A Network ACL is the guard at the main gate of each street (the subnet). A Security Group is the bouncer at the front door of your specific house (the EC2 instance).

Security Groups (SGs) - The Smart, Stateful Bouncer

This is your primary, most-used firewall. It's a stateful firewall that operates directly at the instance's network interface (ENI)

• Core Feature:
  Stateful Inspection. This is its superpower. If you create a rule to allow an inbound web request, the Security Group automatically "remembers" that connection and allows the outbound response to go back to the user. You don't need to create a separate rule for the return traffic. This makes managing application traffic simple and intuitive.

• Rules:
  Allow rules only. If no Allow rule matches the traffic, it is implicitly denied.

• Best For:

  • Application Tier Filtering: Creating fine-grained rules that allow your services to communicate. For example, creating a rule that says "Only allow traffic from instances in the WebApp-SG to connect to instances in the Database-SG on port 3306."
  • Day-to-day access control for your EC2 instances and other resources like RDS databases.

Network ACLs (NACLs) - The Strict, Stateless Guard

This is your broad, network-level firewall that operates at the boundary of a subnet.

• Core Feature:
  Stateless Inspection. This is its defining characteristic. A NACL has no memory. If you allow an inbound request on port 443, you must also create a corresponding outbound rule to allow the return traffic on the high-numbered ephemeral ports (1024-65535). Forgetting this outbound rule is a common cause of connectivity issues.

• Rules:
  Supports both Allow and Deny rules. These rules are evaluated in numerical order, and the first matching rule is applied.

• Best For:

  • Blacklisting: Its ability to create Deny rules makes it the perfect tool to immediately block a known malicious IP address from an entire subnet.
  • Defense-in-Depth: Acting as a broad, secondary layer of defense behind your more specific Security Groups.

Part 2: Private Connectivity - Keeping Your Traffic off the Internet

A core tenet of cloud security is to ensure that your internal resources, like databases or backend processing instances, are not exposed to the public internet. But what if they need to talk to AWS services like S3 or KMS? This is where VPC Endpoints come in.

VPC Endpoints create a private, secure connection between your VPC and AWS services, completely bypassing the internet.

Gateway vs. Interface Endpoints: A Quick Guide

S3 and DynamoDB are special because they can use a simpler, free type of endpoint.

• Gateway Endpoint (The Private Road):

  • For: S3 and DynamoDB only.
  • Mechanism: It works at the routing layer. You create an entry in your subnet's route table that tells your VPC's router to send all S3-bound traffic over a private connection instead of to the Internet Gateway.

• Interface Endpoint (The Private "Front Door"):

  • For: Almost all other AWS services (KMS, Secrets Manager, SQS, etc.).
  • Mechanism: It works at the DNS and networking layer. It places an Elastic Network Interface (ENI) with a private IP address directly inside your subnet. When your application tries to connect to the service's public name, the VPC's internal DNS gives it this private IP instead, keeping the traffic inside your VPC.

A critical security feature for both is the Endpoint Policy, which lets you lock down the endpoint to only allow access to specific resources (e.g., "only allow access to s3://our-company-bucket").

Part 3: Gaining Visibility - Your Network's Audit Trail

You can't secure what you can't see. VPC Flow Logs are your essential tool for network visibility.

• What it is:
  A feature that records metadata about all the IP traffic flowing to and from the network interfaces in your VPC.

• What it tells you:
  Source/Destination IP, Port, Protocol, and crucially, whether the traffic was ACCEPT or REJECT by your Security Groups and NACLs.

• What it DOESN'T tell you:
  It does not record the actual content or payload of your traffic.

• Best For:

  • Troubleshooting: Instantly diagnosing why a connection is failing by seeing REJECT logs.
  • Threat Detection: Identifying suspicious patterns like port scanning (many rejects on different ports) or potential data exfiltration (unusually large data transfers to an unknown IP).

By mastering these foundational controls—Security Groups, NACLs, VPC Endpoints, and Flow Logs—you have the essential toolkit to build a secure and well-architected network foundation for any workload in AWS.