[ SRE_ARENA ]
← BACK TO ROADMAP
NETWORK SECURITY (SG & NACLS)

Network Security: Security Groups & NACLs

DOWNLOADING CONCEPT: 1. SECURITY GROUPS (STATEFUL)...
  • ↳A Security Group (SG) is a virtual firewall that operates at the *Instance* (EC2) level.
  • ↳By default, it denies all inbound traffic and allows all outbound traffic.
  • ↳Crucially, Security Groups are Stateful.
  • ↳If a user sends an HTTP request to your web server (Inbound Port 443), the Security Group remembers the connection state.
  • ↳When the web server replies, the outbound response is automatically allowed through, *even if you have zero outbound rules defined*.
  • ↳You only need to define the inbound rule.
▲ LIVE INCIDENTA developer complains they cannot reach the database. They show you the DB Security Group, and it clearly allows inbound traffic from the Web Security Group.
sre@arena:~/cloud-vpc-2
sre@arena:~$ aws ec2 describe-network-acls --filters "Name=association.subnet-id,Values=subnet-db123"