Route tables, security groups, and network ACLs

Can you explain the difference between stateful and stateless firewall features within AWS VPC, particularly concerning security groups and network ACLs?

Security groups are stateful, meaning that if you send a request from your instance, the response traffic for that request is automatically allowed, irrespective of inbound rules. Network ACLs, on the other hand, are stateless, which means that they do not automatically allow response traffic based on allowed outbound traffic – both inbound and outbound rules should be set explicitly.

How do route tables work within a VPC and what is the significance of the main route table?

Route tables direct network traffic from within a VPC to different destinations. Each subnet in a VPC must associate with a route table, which determines where network traffic is directed. The main route table is the default route table that automatically associates with any new subnet you create within a VPC unless you specify another route table.

Describe how you can secure an Amazon EC2 instance within a VPC using security groups and network ACLs.

To secure an EC2 instance, you can employ both security groups and network ACLs. Security groups are attached to the instance and act as a virtual firewall controlling incoming and outgoing traffic at the instance level. You can define rules based on protocols, ports, and source/destination IP addresses. Network ACLs are applied at the subnet level and provide a layer of security that controls traffic from and to subnets within your VPC.

In AWS, what types of traffic can be controlled by Network ACLs that security groups can’t manage?

Network ACLs can filter traffic based on IP protocol, CIDR block, source/destination ports, and allow for both allow and deny rules, which provides the capability to block IP addresses. They can also control traffic between subnet resources, whereas security groups can’t deny traffic, they only permit specified traffic and cannot explicitly deny certain IP addresses from establishing a connection.

How would updating a route table’s rules affect existing connections to instances within its associated subnets?

Route tables in AWS influence new connections, not existing ones. So, if you update a route table, it will affect new route decisions and how traffic is directed for new connections. Existing connections will remain unaffected as they have been already established using the previous routing rules.

Is it possible to attach more than one security group to an EC2 instance in a VPC, and if so, how do the rules combine?

Yes, multiple security groups can be attached to an EC2 instance. The rules from each security group are aggregated to form a set of permissive rules. AWS evaluates all rules from all security groups associated with the instance to allow traffic.

How would you configure a network ACL to create a demilitarized zone (DMZ) within your VPC?

To create a DMZ, typically you’d place your public-facing instances (such as web servers) in a public subnet. The network ACL for the public subnet should allow traffic from the internet on necessary ports, while the network ACL for the private subnet (where databases or application servers might reside) should allow traffic only from the public subnet. You may need to restrict outbound traffic in the private subnets to ensure resources there cannot initiate communication to the internet directly.

When designing a VPC for high availability, how do route tables play a role?

For high availability, ensure that your VPC has multiple subnets across different Availability Zones. Route tables direct traffic within the VPC, so you will configure them to make sure that there is routing redundancy, there are no single points of failure, and that you have proper routes for each AZ to handle traffic if one AZ becomes unavailable.

What happens if you do not explicitly associate a subnet with a route table in a VPC?

If you don’t associate a subnet with a route table explicitly, it automatically associates with the main route table of the VPC.

How are Network ACLs evaluated by AWS when multiple entries (rules) are applicable to a packet?

AWS evaluates entries in a Network ACL in numeric order, from the lowest to the highest number. The first rule that matches the traffic type (inbound or outbound), source/destination, and protocol is applied irrespective of any other rules that may apply further down the list.

How can you ensure that an EC2 instance in a private subnet can access the Internet for updates without allowing inbound traffic from the Internet?

To provide internet access to an EC2 instance in a private subnet, you can use a NAT Gateway or a NAT instance in a public subnet. This allows the instance to initiate outbound traffic to the Internet and receive a response, but it does not allow unsolicited inbound traffic from the Internet.

What’s the purpose of having both security groups and network ACLs in AWS? Isn’t one type of access control enough?

Having both security groups and Network ACLs provides a layered security approach. Security groups provide instance-level security, acting like a firewall for associated instances. Network ACLs offer a subnet-level layer of security, serving as a second line of defense. They complement each other, allow for stateful and stateless filtering, and can be managed and audited separately to adhere to security best practices and meet various compliance requirements.