The Forgotten NACL

The deployment goes smoothly. Security groups are set on every instance - ports scoped, source IPs locked down. Everything looks right. What nobody checked were the network ACLs, and now the subnet boundary is wide open.

Network Access Control Lists (NACLs) operate at the subnet level - a layer above security groups. They are stateless, meaning both inbound and outbound traffic must be explicitly allowed, including return traffic on ephemeral ports. They evaluate rules in numbered order, and the first match wins. Unlike security groups, NACLs can explicitly deny traffic, making them a powerful coarse-grained perimeter around an entire subnet.

AWS creates a default NACL for every VPC that allows all traffic in all directions. Most teams never replace it. The result is that the subnet boundary provides zero additional filtering - if a security group rule is misconfigured, the traffic passes straight through without a second checkpoint.

In this room, you will investigate a VPC where both subnets use the default NACL, understand the associated risks, remediate them with custom NACLs, and build proper subnet-level network controls from scratch.

Learning Objectives

• Understand how NACLs differ from security groups: stateless vs stateful, subnet-level vs instance-level, rule ordering, and explicit deny capability
• Identify when a subnet is using the default "allow all" NACL instead of a custom, scoped one
• Explain why the default NACL provides no meaningful defense-in-depth alongside security groups
• Create custom NACLs with scoped inbound and outbound rules, including correct ephemeral port handling
• Design a layered network security model that uses NACLs as the subnet perimeter and security groups as the instance firewall
• Verify NACL configurations using the AWS CLI

Prerequisites

• Being able to set up your environment (First Steps Into AWS room)
• Basic Linux commands (Linux Fundamentals room)
• Have a basic understanding of the AWS networking service (Introduction to Cloud Networking room)