AWS Certified Security – SpecialtyDomain 3: Infrastructure SecurityEasy
A financial institution is deploying a new critical application on AWS that requires strict inbound and outbound network traffic control. The application will run on Amazon EC2 instances within a Virtual Private Cloud (VPC). The security team has mandated that only traffic from a specific set of IP addresses should be allowed to reach the application, and the application itself should only be able to communicate with approved internal services. Which AWS service is the MOST appropriate to enforce these granular network access controls at the instance level?
- AAWS Network Access Control Lists (NACLs)
- BAWS Security Groups
- CAWS Shield Advanced
- DAWS WAF (Web Application Firewall)
Show answer & explanationAnswer & explanation
Correct answer: B. AWS Security Groups
Security Groups operate at the instance level, providing stateful filtering for inbound and outbound traffic. This allows granular control over which IP addresses can access the application and which services the application can communicate with, aligning directly with the requirements.
Why the other options are wrong
- A. NACLs are stateless and operate at the subnet level, making them less granular for instance-level control.
- C. AWS Shield Advanced is a managed DDoS protection service, not designed for granular network access control.
- D. AWS WAF operates at the application layer to protect against common web exploits, not granular network access at the instance level.
AWS Security Groups
AWS Security Groups act as a virtual firewall for your EC2 instances, controlling inbound and outbound traffic at the instance level.
- Stateful: automatically allows return traffic for permitted inbound/outbound rules.
- Operate at the instance level, not the subnet level.
- Can be associated with one or more EC2 instances.
Memory trick: Think of Security Groups as a personal bouncer for your EC2 instance, checking IDs for every connection.