‫Now let's talk about
‫network security within our VPC.
‫So we have Network ACL and Security Groups.
‫So if we look at our VPC
‫and look at our Public subnets,
‫we have an EC2 Instance.
‫And the first line of defense for our EC2 Instance,
‫is a NACL or a Network ACL,
‫which is a firewall that is controlling traffic
‫from and to the subnets.
‫So remember, it is at the Subnet level,
‫in which we can define,
‫ALLOW or DENY rules,
‫and then attach at the Subnet level,
‫and the rules can only include IP addresses.
‫So if we look at this diagram,
‫as we can see,
‫the NACL is going to be filtering traffic
‫in and out of the Subnet,
‫before it reaches our EC2 Instance.
‫The second line of defense we have,
‫and we've been already using it
‫so far in this course,
‫are Security Groups.
‫And this is a firewall,
‫that controls traffic to and from an ENI,
‫so lets take network interface,
‫or an EC2 Instance,
‫and the Security Groups can only have ALLOW rules.
‫And finally, they can reference either IP addresses,
‫and other security groups.
‫So in this example,
‫we have the Security Group around our EC2 Instance,
‫that controls the traffic going in
‫and out of our EC2 Instance.
‫So the Security Group and NACL are quite different,
‫the NACL is at the subnet level,
‫and the security group is at the EC2 Instance level.
‫And from an exam perspective,
‫that should be all you need to know.
‫Now there is a more complete,
‫table around the differences of the Security Group
‫and the Network ACL.
‫Let's look at the most important ones
‫and these are the first three.
‫Well, a Security Group operates at the instance level,
‫whereas the network ACL operates at the subnet level.
‫A Security Group supports only ALLOW rules
‫whereas a Network ACL supports
‫ALLOW rules and DENY rules.
‫And finally, in the Security Group,
‫the return traffic is automatically allowed,
‫regardless of any rule,
‫so that's called statefulness,
‫and in Network ACL,
‫the returned traffic must be
‫explicitly allowed by rules
‫which is called stateless.
‫So that's it.
‫Again, from an exam perspective.
‫I really think the first two
‫or the first three rules are enough.
‫So let's go into our default VPC
‫to see what we have.
‫So in our default VPC,
‫on the left hand side, we can see for security,
‫either security groups or Network ACLs.
‫So if I click on security groups,
‫we find the exact same security groups
‫we had from before,
‫when we were using the EC2 console.
‫So this menu right here
‫and the menu in the EC2 console,
‫are the exact same.
‫It depends or if you wanna see it
‫from the perspective of VPC,
‫or if you want to see it
‫from the perspective of an EC2 Instance.
‫So we have five security groups in here,
‫and we can look obviously
‫at the security group rules,
‫for example, for launch-wizard-1
‫which was created from before.
‫As we can see in this security group,
‫the inbound rules allowed HTTP
‫on port 80 and SSH on port 22 from anywhere.
‫For the about rules,
‫it did allow all traffic on all ports,
‫all protocols and anywhere effectively
‫giving our EC2 Instance,
‫the right to talk to any websites.
‫Next for Network ACL
‫that we haven't seen yet,
‫as we can see,
‫one Network ACL has been created,
‫and it is associated at the subnet level,
‫so associated with three subnets.
‫And then where we can look at it,
‫we can see that there are some inbound rules.
‫So this is saying that all traffic
‫on all ports on all from everywhere is allowed,
‫effectively saying that anything can go through it.
‫And you look at the outbound rules,
‫yet again, it's allowing all traffic
‫on all ports anywhere.
‫So this is called the default Network ACL,
‫because it allows everything in
‫and everything out.
‫But if we wanted to,
‫we could create some rules,
‫create a rule number,
‫for example, rule number 200,
‫and then you can define the type of traffic
‫you want it to ALLOW, or DENY
‫in and out of your subnet.
‫Again, remember, Network ACL
‫is at the subnet level.
‫And we can see that,
‫the default Network ACL,
‫has been associated with my three subnets,
‫which is what we would expect from a Network ACL.
‫So that's it. I hope you liked it
‫and I will see you in the next lecture.