Control ports, protocols, and network traffic on AWS

Security Groups act as a virtual firewall for your EC2 instances to control inbound and outbound traffic. When you launch an instance, you can associate it with one or more security groups that you’ve defined.

Inbound Rules: When creating inbound rules, you specify the allowed protocols, ports, and source IP ranges.

Outbound Rules: By default, outbound traffic is allowed on all ports and protocols, but you can modify this to restrict traffic.

Example:

• To allow HTTP traffic on port 80 from any IP address, an inbound rule would look like this:
  

  Type	Protocol	Port Range	Source
  HTTP	TCP	80	0.0.0.0/0

• To allow SSH traffic on port 22 from a specific IP address (e.g., 203.0.113.10):
  

  Type	Protocol	Port Range	Source
  SSH	TCP	22	203.0.113.10/32

Network Access Control Lists (NACLs)

NACLs are an optional layer of security that act as a firewall for controlling traffic at the subnet level. Unlike security groups, NACLs have separate inbound and outbound rules and support allow and deny rules.

Example:

• To deny HTTP traffic on port 80 from a specific IP address (e.g., 198.51.100.5):
  

  Rule #	Type	Protocol	Port Range	Source	Allow/Deny
  100	HTTP	TCP	80	198.51.100.5/32	DENY

AWS Network Firewall

AWS Network Firewall is a managed service that provides advanced capabilities to control and monitor network traffic across your VPCs. It supports stateful inspection, intrusion detection and prevention, and custom rulesets.

• Stateful inspection allows you to monitor and filter traffic based on the connection state, which is crucial for maintaining established connections.
• The service integrates with AWS Firewall Manager for central management of firewall rules across your AWS organization, simplifying the management of your network traffic.

VPC Flow Logs

VPC Flow Logs capture information about the traffic going to and from network interfaces in your VPC. You can create and configure flow log records for a VPC, subnet, or individual network interface.

• Flow logs data can be published to Amazon CloudWatch Logs and Amazon S3 for storage and analysis.

AWS Route 53 Resolver

AWS Route 53 Resolver helps manage DNS queries between your VPC and the internet. By setting up rules to route traffic for particular domains, you control how your network resolves these queries.

• Resolver rules can specify redirection of queries to different endpoints, effectively controlling how your resources access different internet domains.

AWS Transit Gateway

AWS Transit Gateway enables you to connect VPCs and on-premises networks through a central hub, simplifying your network and putting control in your hands.

• By using Transit Gateway route tables and attaching VPCs, you can manage cross-network traffic efficiently and with clear network segmentation in mind.

Best Practices for Traffic Control

1. Principle of Least Privilege: Only allow traffic that is necessary for your applications to function properly.
2. Regular Reviews and Updates: Periodically review and update your security group and NACL configurations to ensure they are up-to-date with your security requirements.
3. Segregation of Duties: Use different security groups for different roles within your architecture (e.g., web servers, database servers).
4. Logging and Monitoring: Utilize services like AWS CloudTrail and VPC Flow Logs to monitor and log network traffic for security and diagnostic purposes.

By implementing these controls effectively, AWS users can ensure the integrity and security of their architecture as expected in the AWS Certified Solutions Architect – Associate exam context. Understanding these concepts, along with their practical implementation, helps in building secure, scalable, and robust cloud solutions on AWS.