Network ACLs

Page 1

Network ACLs

A network access control list (ACL) is an optional layer of security for VPC that acts as a firewall for controlling traffic in and out of one or more subnets.Network ACLs can be set up with rules similar to security groups in order to add an additional layer of security to VPC.

The following are the basic things that you need to know about network ACLs:

• Your VPC automatically comes with a modifiable default network ACL. By default, it allows all inbound and outbound IPv4 traffic and, if applicable, IPv6 traffic.

• A custom network ACL can be created and associated with a subnet. By default, each custom network ACL denies all inbound and outbound traffic until you add rules.

• Each subnet in the VPC must be associated with a network ACL. If its not explicitly associate a subnet with a network ACL, the subnet is automatically associated with the default network ACL.

• A network ACL can be assoicated with multiple subnets; however, a subnet can be associated with only one network ACL at a time. When associated a network ACL with a subnet, the previous association is removed.

• A network ACL contains a numbered list of rules that we evaluate in order, starting with the lowest numbered rule, to determine whether traffic is allowed in or out of any subnet associated with the network ACL. The highest number that you can use for a rule is 32766. It is recommend that you start by creating rules in increments (for example, increments of 10 or 100) so that you can insert new rules

where you need to later on.

• A network ACL has separate inbound and outbound rules, and each rule can either allow or deny traffic.

• Network ACLs are stateless; responses to allowed inbound traffic are subject to the rules for outbound traffic (and vice versa).

Rule number. Rules are evaluated starting with the lowest numbered rule. As soon as a rule matches

traffic, it's applied regardless of any higher-numbered rule that may contradict it