1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints

AWS Solutions Architect Associate SAA-C03

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Solutions Architect Associate (SAA-C03) Exam Study Strategies and Exam Tips for SAA-C03 The AWS Well-Architected Framework

2 Domain 1: Design Secure Architectures (30%)

1.1 IAM Fundamentals — Users, Groups, Roles, and Policies 1.2 AWS Organizations, SCPs, and Multi-Account Strategy 1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints 1.4 Encryption, KMS, and Secrets Management 1.5 AWS WAF, Shield, and Network Firewall 1.6 GuardDuty, Inspector, Macie, and Security Hub 1.7 The Shared Responsibility Model for Solutions Architects 1.8 Data Protection, Compliance, and Audit Services

3 Domain 2: Design Resilient Architectures (26%)

2.1 Elastic Load Balancing (ELB) — ALB, NLB, and GWLB 2.2 EC2 Auto Scaling — Dynamic, Predictive, and Scheduled 2.3 Multi-AZ and Multi-Region Architectures 2.4 Disaster Recovery Strategies — RTO and RPO 2.5 Decoupling with SQS, SNS, and EventBridge 2.6 AWS Step Functions and Workflow Orchestration

4 Domain 3: Design High-Performing Architectures (24%)

3.1 EC2 Instance Types, Purchasing Options, and Placement Groups 3.2 Lambda, Serverless Compute, and Container Services 3.3 Amazon S3 - Storage Classes, Lifecycle, and Performance 3.4 Block and File Storage - EBS, EFS, and FSx 3.5 Database Services - RDS, Aurora, DynamoDB, and More 3.6 CloudFront, Route 53, and Global Accelerator 3.7 Data Ingestion and Transformation - Kinesis, Glue, and EMR

5 Domain 4: Design Cost-Optimized Architectures (20%)

4.1 Compute Cost Optimization — Right-Sizing, RIs, Savings Plans, and Spot 4.2 Storage Cost Optimization — S3 Tiers, EBS, and Data Transfer 4.3 Database Cost Optimization 4.4 AWS Cost Management and Monitoring Tools

6 VPC and Networking Deep Dive

5.1 VPC Architecture — Subnets, Route Tables, and Gateways 5.2 VPC Connectivity — Peering, Transit Gateway, and Direct Connect 5.3 Amazon API Gateway 5.4 CloudFormation and Infrastructure as Code 5.5 AWS PrivateLink and Endpoint Services

7 Migration, Transfer, and Hybrid Services

6.1 The 7 Rs of Cloud Migration 6.2 AWS Snow Family — Snowball Edge Devices 6.3 CloudWatch, CloudTrail, and AWS Config 6.4 Amazon Cognito and Identity Federation 6.5 AWS DataSync and Transfer Family

8 Serverless Architecture and Application Services

7.1 Serverless Architecture Patterns 7.2 Advanced SQS Patterns — DLQ, Backpressure, and FIFO 7.3 Analytics Services — Athena, OpenSearch, and QuickSight 7.4 Container Orchestration — ECS, EKS, and ECR

9 Advanced Topics and Exam Scenarios

8.1 Advanced IAM — Permission Boundaries, Federation, and Cross-Account 8.2 Caching Strategies and ElastiCache Patterns 8.3 Hybrid Architecture — DNS, Storage, and Compute 8.4 SAA-C03 Scenario Practice — Putting It All Together

1.3 VPC Security — Security Groups, NACLs, and VPC Endpoints

Key Takeaways Explain This Topic AI

Security groups are stateful firewalls at the instance/ENI level — allowed inbound traffic has its return traffic automatically permitted.

Network ACLs (NACLs) are stateless firewalls at the subnet level — you must explicitly allow both inbound and outbound, including ephemeral return ports.

VPC endpoints (Gateway and Interface) reach AWS services privately without an internet gateway or NAT device, improving security and cutting NAT costs.

Security groups support only Allow rules; NACLs support both Allow and Deny rules evaluated in number order.

VPC Flow Logs capture IP-traffic metadata to CloudWatch Logs, S3, or Kinesis Data Firehose for monitoring and forensics.

Last updated: October 2026

Quick Answer: Security groups are stateful firewalls at the instance/ENI level with Allow-only rules. Network ACLs (NACLs) are stateless firewalls at the subnet level supporting Allow and Deny . VPC endpoints connect to AWS services privately. Layer all three for defense in depth.

Security Groups (SGs)

A security group is a virtual firewall attached to an Elastic Network Interface (ENI) — on EC2, RDS, Lambda-in-VPC, and more.

• Feature Security Group Behavior
• Level Instance / ENI
• State Stateful — return traffic auto-allowed
• Rules Allow only (no Deny)
• Default Inbound denied, outbound allowed
• Evaluation All rules combined; any match permits
• References Can reference other security group IDs

Because SGs are stateful, an inbound rule for port 443 automatically permits the response — you never write a matching outbound rule. A powerful pattern is chaining by SG reference : the database SG allows port 3306 from the app-tier SG ID , not from an IP range, so scaling the app tier needs no firewall edits.

• Tier Inbound Outbound
• Web 80/443 from 0.0.0.0/0 to app-tier SG
• App 8080 from web-tier SG to db-tier SG
• DB 3306 from app-tier SG default (stateful)
• Network ACLs (NACLs)

A NACL is a stateless firewall at the subnet boundary.

• Feature NACL Behavior
• Level Subnet
• State Stateless — allow inbound AND outbound separately
• Rules Allow and Deny
• Default NACL Allows all in and out
• Custom NACL Denies all until rules added
• Evaluation Lowest rule number first; first match wins

Stateless means responses are not implied. If you allow inbound port 443, you must also allow outbound on ephemeral ports (1024–65535) so replies can leave, and vice versa.

• Rule # Protocol Port Source Action
• 100 TCP 443 0.0.0.0/0 ALLOW
• 120 TCP 22 10.0.0.0/8 ALLOW
• 200 All All 203.0.113.50/32 DENY
• * All All 0.0.0.0/0 DENY (implicit)

On the Exam: "Block a single malicious IP from the whole subnet" → NACL Deny rule (security groups have no Deny). "Allow return traffic was blocked" → you forgot the ephemeral outbound NACL rule.

Side-by-Side

• Feature Security Group NACL
• Scope ENI Subnet
• State Stateful Stateless
• Rules Allow only Allow + Deny
• Order All evaluated First match wins
• Block one IP Cannot Can
• VPC Endpoints

VPC endpoints let resources reach AWS services privately , bypassing the internet gateway, NAT gateway, and VPN.

• Type Mechanism Services Cost
• Gateway endpoint Route-table target S3 and DynamoDB only Free

Interface endpoint ENI with private IP (AWS PrivateLink) Most services (SQS, SNS, KMS, CloudWatch, Secrets Manager, EC2 API…) ~$0.01/hr/AZ + ~$0.01/GB

Benefits: traffic stays on the AWS backbone (security/compliance), you avoid NAT gateway data-processing charges (~$0.045/GB), and latency drops. Gateway endpoints attach to route tables and can be locked down with endpoint policies; interface endpoints carry a private IP and support security groups , and can be reached from on-premises over Direct Connect or VPN.

On the Exam: "Private subnet must reach S3 with no internet" → Gateway endpoint (free). "Private access to SQS / KMS / Secrets Manager" → Interface endpoint (PrivateLink).

VPC Flow Logs

VPC Flow Logs record IP-traffic metadata at the VPC, subnet, or ENI level.

• Property Detail
• Destinations CloudWatch Logs, S3, or Kinesis Data Firehose
• Captures Source/dest IP, ports, protocol, packets, bytes, ACCEPT/REJECT

Does NOT capture Packet payloads, traffic to 169.254.169.254 metadata, DHCP, Amazon DNS, Windows license activation

Use them for connectivity troubleshooting (look for REJECT), anomaly detection, and compliance audits. Remember they log metadata only — they are not a packet capture; for payload inspection use Network Firewall or Traffic Mirroring.

Reading a Connectivity Failure (worked example)

The exam loves "my instance cannot be reached" scenarios that hinge on the SG-vs-NACL interaction. Walk the path in order. Suppose a web server in a public subnet is unreachable on port 443 from the internet. Check, in sequence: (1) the route table has a route to the internet gateway; (2) the NACL allows inbound 443 AND outbound on ephemeral ports 1024–65535 — a missing ephemeral outbound rule is the single most common NACL mistake; (3) the security group allows inbound 443 from the client range.

If inbound works but responses vanish, the culprit is almost always the stateless NACL missing the return-path rule, because the stateful security group would have handled the return automatically.

A second classic: instance A can ping instance B but B cannot reply. Because security groups are stateful, an allowed inbound flow returns freely, so a one-way failure between two instances usually means a NACL is blocking the ephemeral return ports on one subnet, not the security group.

Choosing the Right Private-Connectivity Tool

VPC endpoints are only one option for private access. Match the requirement to the mechanism:

• Requirement Mechanism
• Private subnet → S3/DynamoDB, no internet Gateway endpoint (free)
• Private subnet → SQS/KMS/Secrets Manager Interface endpoint (PrivateLink)

Private subnet → internet for OS updates only (outbound) NAT gateway (zonal, in a public subnet; or regional, with no public subnet)

• Expose your own service to other VPCs/accounts privately PrivateLink endpoint service
• Connect many VPCs and on-premises at scale Transit Gateway

Cost trap: Architects often default to a NAT gateway for S3 access in a private subnet. A Gateway endpoint removes the NAT data-processing charge for that same-Region S3 traffic and reaches S3 without an internet gateway or NAT device — frequently the "most cost-effective and secure" answer.

Defense in Depth Summary

Layered network security combines these controls so that no single misconfiguration is catastrophic: NACLs provide a coarse subnet-level Allow/Deny filter (good for blocking IPs), security groups enforce fine-grained stateful instance rules (the workhorse), endpoints keep AWS-service traffic private, and Flow Logs provide the audit trail to detect and investigate anything that slips through.