Network security basics: security groups and network ACLs

In the old server room, the network was simple. A firewall appliance sat between the internet and everything else, and Mateo's rule of thumb was that anything inside was trusted. When he built his first test servers in AWS, he copied that habit: he opened the Remote Desktop port to the whole internet so he could work from home. Within an hour the Windows security log on the test server showed hundreds of failed sign-in attempts from addresses all over the world.

"Nobody is targeting Cascade Ridge," Gwen said. "They are targeting every open Remote Desktop port on the internet, all day, automatically. In AWS you decide exactly which doors exist, and the default is that none do."

This lesson explains the network layer of security in AWS: the virtual private cloud, the two built-in filters called security groups and network access control lists, and a few habits that keep resources off the open internet. It sits firmly on the customer's side of the shared responsibility model: AWS provides the tools, and the customer decides the rules.

The virtual private cloud

A virtual private cloud (VPC) is a logically isolated network within an AWS Region that belongs to one account. The customer chooses its private address range and divides it into subnets, each in one Availability Zone. A public subnet has a route to an internet gateway, so resources in it can have public addresses. A private subnet has no direct route from the internet; resources there can be reached only from inside the VPC or through deliberate connections.

Cascade Ridge's design follows a common pattern. The internet-facing load balancer for BookVet sits in public subnets. The application servers and the RDS database sit in private subnets, spread across Availability Zones, with no public addresses at all. Traffic from the internet can reach only the load balancer, and the load balancer can reach only the application servers.

Security groups

A security group is a virtual firewall attached to an elastic network interface, which in practice means attached to an EC2 instance, an RDS database, a load balancer or another resource in the VPC. It controls inbound and outbound traffic for that resource.

• Allow rules only. A security group lists what is allowed. Anything not listed is blocked. There is no way to write a deny rule in a security group.
• Stateful. If an inbound request is allowed, the response is automatically allowed back out, and vice versa. You do not write separate rules for return traffic.
• Default behavior. A new security group allows no inbound traffic and allows all outbound traffic, unless you change it.
• All rules evaluated together. There is no rule order; if any rule allows the traffic, it is allowed.
• Sources can be other security groups. A rule can say allow port 8080 from anything in the load balancer's security group, instead of naming addresses.

That last feature is powerful. Gwen's rule for the application servers does not mention any IP address. It allows the application port only from members of the load balancer's security group, and the database's security group allows the database port only from members of the application servers' group. When servers are added or replaced, the rules still hold without editing.

Network access control lists

A network access control list (network ACL) filters traffic at the boundary of a subnet. Every subnet is associated with exactly one network ACL. Network ACLs differ from security groups in ways the exam likes to test.

• Allow and deny rules. A network ACL can explicitly deny traffic, for example from a range of addresses known to be abusive.
• Stateless. Return traffic is not automatically allowed. Rules for inbound and outbound traffic must both permit a conversation, including the range of temporary ports used for responses.
• Numbered rules, evaluated in order. The lowest-numbered matching rule decides, and later rules are not checked.
• Default behavior. The default network ACL that comes with a VPC allows all inbound and outbound traffic. A newly created custom network ACL denies everything until rules are added.

Most organizations rely mainly on security groups, because they are precise and stateful, and use network ACLs as a coarse second layer, for example to block a known bad address range for a whole subnet. Defense in depth, using more than one independent control, means that a mistake in one layer is less likely to expose a resource.

Reading a rule set

Gwen had Mateo read the rules for BookVet aloud as if they were sentences.

The notation 0.0.0.0/0 means every IPv4 address. It is correct for a public website's HTTPS port and almost never correct for anything else. A security group rule allowing Remote Desktop, SSH or a database port from 0.0.0.0/0 is one of the most common findings in security reviews, and AWS Trusted Advisor and Security Hub both flag it.

# Check security group rules for administrative ports open to the whole internet.
risky_ports = {22: "SSH", 3389: "Remote Desktop", 1433: "SQL Server", 3306: "MySQL"}
rules = [
    {"group": "lb-public",  "port": 443,  "source": "0.0.0.0/0"},
    {"group": "app-tier",   "port": 8080, "source": "sg:lb-public"},
    {"group": "mateo-test", "port": 3389, "source": "0.0.0.0/0"},
    {"group": "db-tier",    "port": 1433, "source": "sg:app-tier"},
]
for r in rules:
    if r["source"] == "0.0.0.0/0" and r["port"] in risky_ports:
        print(f"FINDING {r['group']}: {risky_ports[r['port']]} open to the internet")
    else:
        print(f"ok      {r['group']}: port {r['port']} from {r['source']}")

ok      lb-public: port 443 from 0.0.0.0/0
ok      app-tier: port 8080 from sg:lb-public
FINDING mateo-test: Remote Desktop open to the internet
ok      db-tier: port 1433 from sg:app-tier

Managing servers without opening ports

Mateo still needed to manage the Windows servers. Gwen showed him AWS Systems Manager Session Manager, which opens a shell or a port-forwarding session to an instance through the Systems Manager service. The instance needs no inbound ports open at all, access is controlled with IAM, and every session can be logged. He closed the Remote Desktop rule that afternoon and connected through Session Manager instead. The failed sign-in attempts stopped immediately, because there was no longer anything for the scanners to find.

Other network protections

Several other services and features build on the VPC. They appear in later lessons or later courses, but it helps to recognize them now.

• VPC Flow Logs record information about the IP traffic going to and from network interfaces, useful for troubleshooting and investigations.
• AWS Network Firewall is a managed firewall for VPCs that can inspect and filter traffic with more detailed rules than security groups.
• AWS WAF filters web requests to applications; AWS Shield protects against distributed denial of service attacks. Lesson 10 covers both.
• VPC endpoints let resources in private subnets reach AWS services such as S3 without going over the internet.
• Amazon S3 Block Public Access is a separate, account-wide and bucket-level setting that prevents buckets from being made public by mistake.

Public and private by design

The strongest network control is not a rule at all: it is not giving a resource a path from the internet in the first place. Gwen's design checklist for every new workload starts with placement. Does this resource need to be reached from the internet? If not, it goes in a private subnet with no public address, and the question of which internet ports to open never arises. For Cascade Ridge, the answer was yes only for the BookVet load balancer and, later, the public website's content delivery network. Everything else, including the practice system, the database, the imaging archive and the backup servers, lives in private subnets or is a managed service reached through private endpoints.

Resources in private subnets still sometimes need to make outbound connections, for example to download operating system updates. A NAT gateway in a public subnet lets private resources start outbound connections to the internet while preventing the internet from starting connections to them. VPC endpoints are even better where they exist, because traffic to AWS services such as S3 or Secrets Manager then never leaves the AWS network.

Connecting the clinics

The eleven clinics and the emergency hospital need to reach the practice system in AWS. Publishing VetLedger on the internet would be the wrong answer. Instead, Gwen planned an AWS Site-to-Site VPN: encrypted tunnels over the internet from each site's router to the VPC, so clinic computers reach the private application as if it were on the office network. If traffic grows, AWS Direct Connect, a dedicated private connection from a data center or office to AWS, is an option for the head office. The security groups then allow the application port from the clinics' address ranges and from nowhere else.

Testing the rules

Rules that look right on paper can still be wrong. AWS provides tools that check reachability without sending real traffic, such as VPC Reachability Analyzer, which traces whether one resource can reach another and which rule blocks it, and Network Access Analyzer, which finds unintended paths, such as a database reachable from the internet. Mateo used Reachability Analyzer to confirm that the database could not be reached from the public subnet, and kept the result as evidence for Hannah's audit file.

Mateo kept a simple register of every rule that allows traffic from outside the VPC: the resource, the port, the source and the reason. At first it had six entries. Gwen asked him to review it monthly, and to treat any rule that nobody could explain as a finding to remove. Over time, the register became the quickest way to answer an auditor's favorite question: show me everything that is reachable from the internet, and tell me why.