Two firewalls, one stateless, evaluated in a fixed order.
Inbound: NACL first, then Security Group. Outbound: the order reverses.
Inbound — subnet boundary (NACL)Stateless, numbered rules, lowest number wins first match
Inbound — ENI boundary (Security Group)Stateful, only reached if the NACL allowed it through
Best practice: Security Groups do the real fine-grained control; NACLs stay broad — a coarse defense-in-depth layer for blocking a known-bad CIDR, not the primary control.