VPC security and connectivity

Two layers of firewall

A VPC gives you two firewalls. Security groups (SGs) guard each network interface, so each instance. Network ACLs (NACLs) guard each subnet boundary. Most teams do almost everything with security groups and keep NACLs simple, using them for broad blocks such as "deny this attacking IP range".

Security groups that reference each other

Instead of IP addresses, a security group rule can name another security group as the source. "Allow port 5432 from sg-app" means any instance that has sg-app attached may connect, even as instances are added or replaced by auto scaling. This is the standard way to build tiers: the load balancer SG allows 443 from the internet, the app SG allows 8080 only from the load balancer SG, and the database SG allows 5432 only from the app SG.

aws ec2 authorize-security-group-ingress --group-id sg-0db111 --protocol tcp --port 5432 --source-group sg-0app222

Network ACLs and ephemeral ports

Because NACLs are stateless, you must allow the reply traffic too. When a browser connects to your server on port 443, the reply goes back to a random high port on the client, called an ephemeral port. A NACL that allows inbound 443 must also allow outbound traffic to ports 1024 to 65535, or replies are dropped. Rules are checked from the lowest number up, and the first match decides. If nothing matches, the final rule, shown as *, denies the packet.

VPC endpoints: reach AWS services privately

• Gateway endpoints: for S3 and DynamoDB only. They add a route in your route table, cost nothing, and keep traffic off the NAT gateway.
• Interface endpoints (powered by AWS PrivateLink): a private network interface in your subnet for many other services, such as Secrets Manager, SQS or ECR. They are charged per hour and per GB. PrivateLink can also expose your own service privately to other VPCs.

aws ec2 create-vpc-endpoint --vpc-id vpc-0abc --service-name com.amazonaws.ap-south-1.s3 --route-table-ids rtb-0priv

Connecting networks

• VPC peering: a private link between two VPCs (even in other accounts or regions). It is not transitive: if A peers with B and B with C, A still cannot reach C. CIDR ranges must not overlap.
• Transit Gateway: a regional hub. Attach many VPCs and VPN connections to it instead of building a mesh of peerings.
• Site-to-Site VPN: encrypted IPsec tunnels over the internet from your office router to AWS. Quick to set up; each connection has two tunnels for redundancy.
• Direct Connect: a dedicated private line from your data centre to AWS through a partner location. More consistent speed and latency, but it takes weeks to set up and is not encrypted by default, so many teams run a VPN or MACsec over it.

VPC Flow Logs

Flow Logs record metadata about IP traffic on a VPC, subnet or network interface: source and destination address and port, protocol, bytes, and whether it was ACCEPTed or REJECTed. They do not capture packet contents. Send them to CloudWatch Logs or S3 and use them to debug "why can my app not reach the database" or to spot scans.

2 111122223333 eni-0a1b2c3d 198.51.100.7 10.0.1.25 49152 22 6 3 180 1760870000 1760870060 REJECT OK