Network ACLs vs. Security Groups - AWS

Network ACLs are used to control traffic at the network layer (layer 3 of the OSI model). They are used to allow or deny traffic based on the source and destination IP addresses and port numbers. Network ACLs are implemented at the level of the subnet and operate at the edge of the network, meaning they are the first line of defense against incoming traffic. Network ACLs can be used to block traffic from specific IP addresses or ranges of IP addresses, or to allow traffic from specific IP addresses or ranges of IP addresses.

Security groups, on the other hand, are used to control traffic at the transport layer (layer 4 of the OSI model). They are used to allow or deny traffic based on the protocol and port number. Security groups are implemented at the level of the individual resource (such as an EC2 instance or RDS database) and operate within the network. Security groups can be used to allow traffic from specific IP addresses or ranges of IP addresses, or to allow traffic from specific protocols or port numbers.