EasyExperience level: 3-5 years1 min read

Security Groups vs Network ACLs — how do they differ, and when do you use each?

Reviewed by Gurusankar M.

Asked inAmazonCognizantAccentureDeloitte
#security group#nacl#stateful#stateless#vpc security
Report issue

Short Answer

Security Groups are stateful, instance-level firewalls (return traffic auto-allowed, allow rules only). NACLs are stateless, subnet-level (evaluate inbound AND outbound separately, support explicit deny). SGs are your primary control; NACLs add coarse subnet-level allow/deny (e.g. block an IP range).

On this page

Concept Made Simple

Coffee Chat Question

“Security Groups vs Network ACLs — how do they differ, and when do you use each?”

Remember It Faster

Mind Map Answer

Security Group
stateful, instance-level, allow-only
NACL
stateless, subnet-level, allow + deny
Primary
SGs for most control
NACL for
coarse subnet deny (block IP range)

Think Beyond the Expected

What If?

You open an inbound port in a NACL but traffic still fails — why?

NACLs are stateless: you must also allow the OUTBOUND return traffic (ephemeral ports), unlike stateful Security Groups which auto-allow return traffic. Forgetting the ephemeral-port outbound rule is the classic NACL gotcha.

Real World

Teams manage access mostly with Security Groups (referencing other SGs); NACLs are used sparingly for subnet-wide deny rules. The stateless ephemeral-port trap is a common debugging snag.

Interviewer's Expectation

Keywords they're listening for:

  • SG stateful/instance/allow-only
  • NACL stateless/subnet/allow+deny
  • SG primary
  • ephemeral ports for NACL return traffic

Common Mistakes

  • Forgetting NACL outbound/ephemeral rules
  • Using NACLs where SGs suffice
  • Overly-broad 0.0.0.0/0 inbound rules

Best Practices

  • Use SGs as the primary control; reference SGs
  • NACLs for coarse subnet deny only
  • Least-privilege ingress; avoid open 0.0.0.0/0

Follow-up Questions

  1. Why can a Security Group reference another Security Group?
  2. What are ephemeral ports and why do NACLs need them?
  3. Default SG and NACL behavior?

Continue Learning with AI

Take this question deeper with your favourite AI assistant. Pick a depth, copy the prompt, or open it directly — AI is your learning companion, not a shortcut.

Plain-language foundations

I'm preparing for a software engineering interview and want to understand this from scratch, as a beginner.

Topic: VPC (AWS)
Interview question: "Security Groups vs Network ACLs — how do they differ, and when do you use each?"

Please:
1. Explain the core idea in simple, plain language, using an everyday analogy.
2. Define any technical terms you use.
3. Walk through one small, concrete example.
4. Finish with a single sentence I can easily remember.

Keep the tone friendly and assume I'm new to this topic.
Open inChatGPTGeminiClaude

Was this answer helpful?

Affiliate links

Tools for Your Developer Workspace

Equipment for a comfortable, productive setup.

As an Amazon Associate I earn from qualifying purchases.