Two firewalls, two layers, evaluated in a fixed order

Speaker notes

• A Network ACL (NACL) operates at the subnet boundary, evaluates numbered rules in order from lowest to highest until a match is found, and is stateless, meaning an allowed inbound rule does not automatically permit the matching outbound response; you write both directions explicitly.
• The evaluation order for a packet entering a subnet: NACL first (subnet boundary), then Security Group (ENI boundary) if the NACL allows it through. For a packet leaving, the order reverses: Security Group first, then NACL on the way out. Missing this order is a common source of 'my Security Group looks right but the traffic still doesn't work' debugging sessions, when the actual block is the NACL.
• Best practice: Security Groups do the real, fine-grained access control (per-service, per-source), and NACLs stay broad, a coarse defense-in-depth layer for explicitly blocking a known-bad CIDR range at the subnet boundary, not the primary control mechanism. Reversing that division of labor, complex NACL rules and permissive Security Groups, makes the network harder to reason about for no real security gain.

Deck map