Lecture 226: Recap - Security Groups and Network ACL
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：10:18
- 来源：Udemy Lecture 28714178
- Slide 数量：7
- 画面切换：02:08、03:37、04:16、05:19、06:42、07:39
扫描说明
逐条读取了 Udemy 页面中的 149 条英文 Transcript cue，并按时间轴扫描全长约 10:18 的视频。依据 Security Group、Network ACL 对比，以及 Direct EC2、ALB、NLB、CloudFront 四类 Blocking Architecture 划分为 7 个小节。7 张截图均在 Transcript 侧栏关闭、播放器控件隐藏后复核，统一为 1364×770。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. Security Group：ENI-level、Stateful、Allow-only
时间范围：00:00–02:08
总结 / Summary
中文
Security Group 关联 ENI，因此不仅用于 EC2，也可保护带 ENI 的 RDS、VPC 内 Lambda 等 Resource。它只包含 Allow Rule，并且是 Stateful：已允许的 Connection，其 Return Traffic 自动放行，不必为反向流量再写规则。Source/Destination 可用 CIDR，也可引用另一个 Security Group；典型做法是 EC2 SG 只允许来自 ALB SG 的 Traffic。VPC Peering 场景在满足条件时也支持跨 VPC 引用 SG。新建 SG 默认无 Inbound Allow，Outbound 默认允许全部。
English
Security groups associate with ENIs, so they protect EC2 as well as ENI-backed resources such as RDS and Lambda in a VPC. They contain allow rules only and are stateful: return traffic for an allowed connection is admitted automatically. Sources or destinations can use CIDRs or another security group; a common pattern lets an EC2 security group accept traffic only from the ALB security group. Security-group references can also work across VPC peering when requirements are met. A new security group has no inbound allows and permits all outbound traffic by default.
Transcript
00:00 So in this section, as we are talking about the security, I thought, uh, it would be good to recap
00:10 the security group and network ACL first before we move to the other, uh, network firewall that AWS
00:11 provides.
00:16 So security group, it can be applied to EC2 instances.
00:20 And these security group allows you to have the allow rules.
00:24 Right.
00:24 And security groups are actually associated with the Enis right.
00:29 Whether that Eni is for EC2 or RDS instance or Lambda function inside a VPC.
00:35 Now security groups are stateful.
00:37 That means any traffic that is coming in the outbound traffic is allowed automatically, and the other
00:44 way round, if any traffic is going out of your Eni, then the return traffic from the destination will
00:51 also be allowed automatically.
00:53 And that's what the stateful means.
00:55 Now security Group can reference the Cidr notation when you provide the source IP address range in inbound
01:02 rules or destination address range in the outbound rules, and additionally it can also refer to another
01:08 security group.
01:10 And this is a typical scenario where.
01:11 Suppose you have the Alb and your EC2 instance is behind the Alb.
01:15 Then you want to allow all the traffic from Alb to reach to the EC2 machine.
01:20 In that case, in EC2 security group, you will allow the you know the traffic from security group of
01:28 your Alb.
01:29 Also, security group can be referenced across VPC peering.
01:33 So if there is a VPC peering connection and EC2 instances are launched across this VPC peering connections,
01:40 then one EC2 instance security group can refer to other EC2 instance security group in another VPC.
01:48 Now similar use case like Alb that I just explained.
01:53 Now by default there is no inbound rule in the security group and all outbound traffic is allowed.
02:00 Now this is true when you create a security group and you don't add any rule by yourself, right?
02:06 That's a default behavior.
2. Network ACL：Subnet-level、Stateless、支持 Explicit Deny
时间范围：02:08–03:37
总结 / Summary
中文
Network ACL 作用于 Subnet Boundary，规则按编号顺序匹配，既支持 Allow 也支持 Deny，并且是 Stateless：Inbound 与 Outbound 必须分别放行，Return Traffic 也需要对应 Rule。NACL 以 CIDR 为 Source/Destination，不能引用 Hostname 或 Security Group。考试常见陷阱是：VPC 的 Default NACL 初始允许全部，而新建 Custom NACL 初始没有 Allow Rule，最终 * DENY 会阻断全部。要封锁少量恶意 IP，SG 无法写 Deny，NACL 才是直接工具。
English
A network ACL applies at the subnet boundary, evaluates numbered rules in order, supports both allow and deny, and is stateless: inbound and outbound directions—including return traffic—must be permitted separately. NACLs use CIDRs rather than hostnames or security-group references. A common exam distinction is that the VPC's default NACL initially allows all traffic, while a newly created custom NACL has no allow entries and the final * DENY blocks everything. Security groups cannot express a targeted deny, so NACLs are the direct control for blocking a small set of malicious IPs.
Transcript
02:08 Now in case of network ACL, as you know they operate at the subnet level right.
02:13 And they are stateless.
02:16 That means you have to define the rule for both inbound and outbound traffic as well.
02:23 So it's not like a security group again.
02:26 Um you can reference a Cidr range but not the host name.
02:31 Now by default it denies all inbound and denies all outbound traffic.
02:36 Now when we say default, which means when you create a new network ACL, then there are no inbound
02:42 and outbound rules.
02:43 That means the traffic cannot really flow.
02:46 Because at the end there is a deny rule in the network ACL.
02:51 Okay.
02:52 So that's the basics about security groups and network access control list.
02:57 And just thing to remember is that the security groups are stateful and network ACL are stateless.
03:03 And other important thing is that security group only have allow rules, whereas network ACL also supports
03:10 the Deny rules, which also means that if you want to block a traffic from certain IP address, then
03:17 you cannot use security group.
03:19 But you would have to use network ACL because imagine a case that your server is experiencing some attacks
03:27 from some malicious IPS.
03:29 Then if you want to only block those particular IPS, there is no provision in the security group because
03:35 there you only have allow rules.
3. Public EC2 直接暴露时，在其 Subnet NACL 拒绝 Malicious IP
时间范围：03:37–04:16
总结 / Summary
中文
当 Internet Client 直接访问带 Public IP 的 EC2，Packet 到达 Instance 前仍经过所在 Subnet 的 Network ACL。若要阻止某个 Malicious Source IP，可在 Inbound NACL 中加入更低 Rule Number 的 DENY，再保留其他需要的 ALLOW。Security Group 继续定义业务允许范围，但不能用来写 Explicit Deny。因为 NACL Stateless，还必须确认 Outbound/Ephemeral Port Rule 不会破坏正常 Return Traffic。
English
When Internet clients access an EC2 instance with a public IP directly, packets traverse the subnet's network ACL before reaching the instance. To block a malicious source, add an inbound deny with a lower rule number than broader allows, while retaining the required allow rules. The security group still defines permitted application traffic but cannot express an explicit deny. Because the NACL is stateless, outbound and ephemeral-port rules must also preserve valid return traffic.
Transcript
03:37 Right now with that context, let's look at some of the architectures that may come up when you use
03:44 security groups and network ACLs together, and primarily in the case where you want to block those
03:50 malicious IP addresses.
03:52 Okay.
03:53 So this is a simple use case where there is a EC2 instance with public IP.
03:57 And this is being accessed over the internet.
04:00 Right.
04:00 And EC2 has a security group.
04:03 And now if you want to block a particular malicious IP, you know that security group cannot do that.
04:08 And hence in that case, you would have to add a rule into the network ACL inbound rules and deny the
04:13 traffic from that malicious IP.
4. ALB 不向 Target 保留 Packet Source IP，Deny 应放在 ALB Subnet
时间范围：04:16–05:19
总结 / Summary
中文
ALB Terminate Client Connection，再从 Load Balancer Node 建立到 Target 的新 Connection。EC2 Target 在 Network Layer 看到的是 ALB Node Source，而原始 Client IP 通过 X-Forwarded-For 等 Header 传递。因此在 EC2 Subnet NACL 中封锁 Client IP 无效；需要在 Public ALB Subnet 的 NACL 上 Deny。与此同时，EC2 SG 的 Source 应引用 ALB SG，确保 Instance 只能由 Load Balancer 访问。
English
An ALB terminates the client connection and opens a new connection from a load-balancer node to the target. At the network layer, the EC2 target sees the ALB node as the source; the original client IP is carried in headers such as X-Forwarded-For. Therefore, denying the client IP in the EC2-subnet NACL is ineffective—the deny belongs on the public ALB subnets. The EC2 security group should simultaneously reference the ALB security group so only the load balancer can reach the instance.
Transcript
04:16 So this is very simple use case.
04:16 Now another use case when you have Alb in front of your EC2 instances.
04:19 Now in this case again because EC2 receives the traffic from the Alb.
04:29 In that case, if you want to block traffic at EC2 subnet level, it is not going to help, right?
04:36 So having the network ACL at this subnet is useless, which means if you want to block again traffic
04:42 from the malicious IP addresses from the client side, then you would have to put the network ACL at
04:49 the Alb subnet level, right.
04:52 So I hope it is understood.
04:54 And further, if you want to make sure that this EC2 only receives the traffic from the application
04:59 load balancer, then in the EC2 security group, you will allow the traffic only from the Alb security
05:06 group.
05:06 So you are sure that EC2 doesn't get traffic from anywhere else.
05:11 But otherwise for blocking the traffic you would have to use network ACL, right?
05:17 So I hope it is understood.
5. NLB Client IP Preservation 允许 Target Subnet NACL 识别 Client
时间范围：05:19–06:42
总结 / Summary
中文
对 EC2/Instance Target 启用 NLB Client IP Preservation 时，Target 可以在 Packet Source 中看到原始 Client IP，因此 EC2 Subnet NACL 能按该 IP Deny。但 Malicious Traffic 已经进入并经过 NLB，仍可能产生 Processing/Data Charge；更早在 NLB Subnet NACL 阻断通常更高效。NLB 从 2023 年起支持 Security Group，但 SG 仍是 Allow-only，不能代替 NACL 的 Explicit Deny。
English
When NLB client-IP preservation is enabled for instance targets, the target sees the original client source in the packet, allowing the EC2-subnet NACL to deny that IP. However, the malicious traffic has already traversed the NLB and may still incur processing or data cost, so blocking earlier at the NLB-subnet NACL is often preferable. NLBs have supported security groups since 2023, but security groups remain allow-only and do not replace an explicit NACL deny.
Transcript
05:19 Now what if you have the NLB right?
05:22 So when you have the NLB things are quite similar.
05:26 But you know that NLB also does client IP preservations.
05:31 If the target is for example, EC2 instances, which means that EC2 instance directly sees the client
05:39 IP address, right?
05:41 So in this case, if there is a client IP preservation, then you can also apply the network ACL at
05:50 this EC2 subnet level.
05:51 And you can block that traffic.
05:54 So this is very much possible.
05:56 But one downside is that all that traffic will still flow through the network load balancer.
06:02 And there will be cost for that traffic as well.
06:04 Right.
06:05 So while this is possible, what you could also do is of course you can also have the security Group
06:10 for network load balancer.
06:12 Now this was released in summer 2023, but otherwise earlier network Load Balancer did not have the
06:18 security group.
06:19 But in this scenario, as we discussed, security Group won't help to block the traffic and it is ideal
06:28 to block this traffic at the network load balancer subnet level.
06:33 Right.
06:33 So again very similar to what we did for the application load balancer.
06:39 Okay.
06:40 So I hope that is also understood.
6. CloudFront 前置时 ALB 只看到 Edge IP，Client Filtering 放到 WAF
时间范围：06:42–07:39
总结 / Summary
中文
当 CloudFront 位于 Public ALB 前，ALB Connection 的 Source 是 CloudFront Edge/Origin-facing IP，而不是最终 Client。此时在 ALB Subnet NACL 中 Deny Client IP 不会命中，并可能误伤 CloudFront。应把 IP Reputation、IP Set 与 Layer 7 Attack Filtering 放到关联 CloudFront 的 AWS WAF；DDoS Protection 则由 AWS Shield 承担。NACL 仍可用于 Subnet Boundary，但不适合在这个位置识别原始 Viewer IP。
English
With CloudFront in front of a public ALB, the ALB connection originates from CloudFront edge or origin-facing addresses rather than the end client. Denying a viewer IP in the ALB-subnet NACL will not match and may instead disrupt CloudFront. IP reputation, IP sets, and Layer 7 attack filtering belong in AWS WAF associated with CloudFront, while AWS Shield handles DDoS protection. NACLs still provide subnet boundaries but cannot identify the original viewer at this point.
Transcript
06:42 And now just one more scenario.
06:44 What if you have Amazon CloudFront in front of your application load balancer right now.
06:50 Because application load balancer now receives the traffic from CloudFront IP addresses.
06:56 Again you cannot use the network ACL at the Alb subnet level because in that you would have to block
07:02 particular IP address.
07:04 But Alb is only seeing the IP address of CloudFront distribution, right?
07:09 So even if you put the network ACL and add the deny rules.
07:12 It is not going to help, right?
07:15 So what do you do in this case?
07:17 So in this case generally what you will do you will use different AWS firewall service.
07:23 And that is AWS WAF web Application firewall.
07:27 Or there is also AWS shield which is used for DDoS protection.
07:31 And in the following lectures we are going to talk in depth about this additional AWS firewall services.
07:38 Okay.
7. 用 CloudFront Managed Prefix List 与 SG Reference 强制唯一访问路径
时间范围：07:39–10:18
总结 / Summary
中文
完整的 Origin Protection 需要同时锁定两跳。ALB SG 的 Inbound Source 使用 AWS-managed Prefix List com.amazonaws.global.cloudfront.origin-facing，只允许 CloudFront Origin-facing Server，而不手工维护大量 IP；EC2 SG 再只允许 ALB SG。Viewer 先由 CloudFront 上的 WAF 过滤，随后只有 CloudFront 能连接 ALB，只有 ALB 能连接 EC2，从而阻止攻击者绕过 Edge 直接访问 Origin。
English
Complete origin protection locks down both hops. The ALB security group's inbound source uses the AWS-managed prefix list com.amazonaws.global.cloudfront.origin-facing, allowing CloudFront origin-facing servers without manually maintaining a large IP list. The EC2 security group then allows only the ALB security group. Viewers are filtered by WAF at CloudFront, only CloudFront can reach the ALB, and only the ALB can reach EC2, preventing direct bypass of the edge.
Transcript
07:39 So before we stop for this lecture, there might be one question that might be coming to you is how
07:46 do you really make sure that this application instance only receives the traffic from this particular
07:52 path.
07:53 Right.
07:54 So in this particular scenario, what you can do is you can use security group rules, as we discussed
08:00 earlier, where EC2 security group will have the inbound rule and the source will be the application
08:05 load balancer security group.
08:07 So this makes sure that EC2 only receives the traffic from the Alb.
08:13 But how do you make sure that this Alb only receives the traffic from the CloudFront, and you take
08:21 care of the scenario where end client or say, malicious IPS are directly hitting the Alb?
08:27 How do you really block that traffic?
08:29 Right.
08:30 So in that case, because this network ACL is not useful anyways, what we would have to do is in the
08:36 application load balancer security group, we would have to whitelist or allow CloudFront public IP
08:43 addresses.
08:45 Now again CloudFront is not a, you know, small service.
08:48 It might have hundreds and thousands of IP addresses.
08:51 Right.
08:52 So you can't, you know, list all those IPS into the security group inbound rule.
08:58 But for that we have already discussed AWS has something called IP prefix list.
09:04 So there are specific prefix list for different AWS services including CloudFront.
09:10 And it is mentioned in IPS JSON file.
09:13 So I think we have covered this somewhere else right?
09:16 So in this case, what we would have to do is in the Alb security Group, we would have to add the allow
09:22 rule with the CloudFront prefix list.
09:25 And the prefix list for CloudFront IP addresses is identified with this particular name.
09:32 Now once you do that and once you have this AWS WAF with CloudFront which blocks the malicious IP,
09:39 this is end to end secure, because now Alb is only receiving the traffic from CloudFront and EC2 is
09:46 only receiving the traffic from the Alb.
09:49 Right?
09:50 So this is how you basically use the security group and the network ACLs together to either allow or
09:57 block the traffic.
10:00 Right.
10:00 So that's it for this lecture.
10:02 And in the rest of the section we are going to talk about other AWS networking security services.
10:08 And we will see what they offer.
10:12 Right.
10:13 So we'll stop here.
10:14 And with that let's go to the next lecture.
10:16 Thank you.
整讲总结 / Overall Summary
中文
Security Group 与 Network ACL 的核心区别是 ENI-level/Stateful/Allow-only 对比 Subnet-level/Stateless/Allow+Deny。Blocking Rule 必须放在仍能看到原始 Client IP 的位置：Direct EC2 放目标 Subnet，ALB/NLB 通常更早放 Load Balancer Subnet；CloudFront 场景则把 Viewer Filtering 放到 WAF。再用 CloudFront Managed Prefix List 限制 ALB Source、用 ALB SG 限制 EC2 Source，可形成不可绕过的 Edge-to-Origin Path。
English
Security groups are ENI-level, stateful, and allow-only; network ACLs are subnet-level, stateless, and support allow and deny. A blocking rule must sit where the original client IP is still visible: at the target subnet for direct EC2, usually the load-balancer subnets for ALB or NLB, and in WAF for CloudFront viewers. Restricting the ALB to the CloudFront managed prefix list and EC2 to the ALB security group creates an edge-to-origin path that cannot be bypassed directly.
返回顶部 ↑