Infrastructure Security is worth 18% of the exam. These notes compare controls that look alike (security groups and NACLs) and cover private access to S3, administrative access without open ports and rate limiting at the edge.
| Feature | Security group | Network ACL |
|---|---|---|
| Where it applies | Resources it is associated with, such as an EC2 instance | The subnet boundary: traffic entering and leaving the subnet |
| State | Stateful: return traffic is allowed automatically | Stateless: return traffic must be allowed explicitly |
| Rules | Inbound and outbound rules by source or destination, port range and protocol | Allow and Deny rules numbered 1 to 32766; lowest number first, first match wins |
| Association | Several security groups can be assigned to one resource | One NACL per subnet (default NACL if none); a NACL can cover several subnets |
| Traffic not filtered | DNS, DHCP, instance metadata, Time Sync Service, reserved VPC router IPs | The same list |
Source: docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Security groups are STATEFUL (the response is allowed automatically); NACLs are STATELESS: you must also allow the return traffic. NACLs act at the subnet boundary, not on traffic within the subnet.
Official source: docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
NACL rules (1 to 32766) are evaluated from the lowest number to the highest, and the first match is applied and evaluation stops. They support Allow and Deny. Number rules in steps of 10 or 100 so you can insert rules later.
Official source: docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Every subnet must have a NACL; if you don't associate one, it uses the default NACL. A NACL can be associated with several subnets, but a subnet has only one NACL at a time (associating another removes the previous one).
Official source: docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html
Neither security groups nor NACLs filter traffic to/from Amazon DNS, DHCP, instance metadata (IMDS), the Time Sync Service or the reserved VPC router IPs. For DNS use Route 53 Resolver DNS Firewall; for IMDS, its metadata options.
Official source: docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
Don't open SSH (22) or RDP (3389) to 0.0.0.0/0 or ::/0: restrict to specific ranges. Don't open large port ranges, authorize only specific IAM principals to modify security groups, and consider similar NACLs as an extra layer.
Official source: docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
Session Manager gives access to nodes with no inbound ports, no bastion hosts and no SSH keys, controlled only with IAM policies. It logs activity to CloudTrail, S3 and CloudWatch Logs, with TLS 1.2 and SigV4-signed requests.
Official source: docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
Session logging is NOT available when you connect through port forwarding or SSH, because SSH encrypts everything inside the TLS tunnel. For nodes without a public IP, use Systems Manager VPC endpoints with PrivateLink.
Official source: docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html
The S3 gateway endpoint has no charge and works through a route table entry, with no internet gateway or NAT. It does NOT work from on-premises, VPC peering across Regions or transit gateway: there you need an interface endpoint (which has a cost).
Official source: docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
You cannot use aws:SourceIp in policies for S3 requests that go through a VPC endpoint; use aws:VpcSourceIp. To restrict by endpoint or VPC use aws:sourceVpce or aws:sourceVpc in the bucket policy.
Official source: docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
A bucket policy that denies everything except a specific VPC endpoint also blocks access from the management console. The endpoint's default policy is full access; use aws:PrincipalArn to limit it to specific roles.
Official source: docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
A rate-based rule counts requests grouped by your criteria and limits those arriving too fast. It supports a scope-down statement, cannot be nested, and each web ACL where you use it is an instance with its own count.
Official source: docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html
A rate-based rule costs 2 WCU as a base, plus 30 WCU for each custom aggregation key, plus whatever its scope-down statement costs.
Official source: docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html
Answer practice questions, then review your mistakes with spaced repetition.