Perimeter and VPC controls: Shield and WAF, security groups and network ACLs.
AWS network security is layered: no single control is expected to stop every attack. Traffic from the internet meets DDoS protection and a web application firewall at the edge, then subnet-level and instance-level packet filters inside the VPC. Knowing which layer owns which decision avoids both gaps and duplicated, conflicting rules.
AWS Shield and AWS WAF together form the edge defence for internet-facing AWS workloads. Shield protects against L3 / L4 (network and transport) DDoS…
VPC Security Groups (SGs) and Network ACLs (NACLs) are the two packet-filtering primitives that AWS provides inside a VPC. They sit at different boundaries…
AWS Shield Standard is on by default for every account and absorbs common volumetric and protocol attacks at the network and transport layers; Shield Advanced adds response-team support and cost protection. AWS WAF inspects HTTP requests at CloudFront, an Application Load Balancer or API Gateway and applies rules such as rate limits, IP sets, managed rule groups and SQL-injection or XSS matching. Inside the VPC, network ACLs filter packets at the subnet boundary with ordered allow and deny rules, and security groups filter at each network interface with allow-only rules that track connection state.
| Goal | Use | Notes |
|---|---|---|
| Absorb volumetric DDoS | Shield | Standard is automatic; Advanced for critical apps |
| Block bad HTTP patterns or rate-limit clients | WAF | Attach to CloudFront, ALB or API Gateway |
| Allow app tier to reach database tier | Security group | Reference the source SG instead of CIDRs |
| Explicitly deny a CIDR for a whole subnet | NACL | Only NACLs support deny rules |
| Default posture for new resources | Security group | Deny-all inbound until a rule allows it |
In practice most teams keep NACLs close to the default allow-all and express intent in security groups, because stateful rules are easier to reason about. NACLs are reserved for coarse subnet isolation or emergency blocks. Remember that NACLs are stateless, so a rule allowing inbound traffic needs a matching outbound rule for the ephemeral return ports.
Network controls work together with identity: see Identity & Secrets for IAM and key management, and Detection for finding traffic that got through. Host-level filtering on a single server is covered under Fail2Ban.