VPC Security

Security Groups (SGs)

Definition	Virtual STATEFUL FWs (separate sets for inbound/outbound)
Default	ALLOW comms between all resources within the same SG NO INBOUND IS ALLOWED ALLOW all OUTBOUND traffic DENY all other traffic Can be altered, not deleted DIRECTION SRC PROT PORT INFO INBOUND sg-xxx ALL ALL allow all INBOUND from instances within SG OUTBOUND 0.0.0.0/0 ALL ALL allow all OUTBOUND
Rules	<= 500 SG in 1VPC <= 50 inbound & <= 50 outbound rules in 1SG (for more, <=5 SG for each ENI) You can specify ALLOW, not DENY rules (main different from ACLs) Separate rules for INBOUND/OUTBOUND Are STATEFUL = responses to allowed inbound are allowed outbound & viceversa (!= from ACLs) Instances associated with same SG cannot talk to each other unless you add rules allowing it (exception being the default SG)

ACLs

Definition	STATELESS FW on a SUBNET level Numbered list of rules evaluated in order (starting from low number) to determine which traffic is allowed in/out subnet Default deny (there's an immutable final deny rule that matches all) Every subnet must be associated with ACL
Default	VPC created with modifiable default ACL associated with each subnet ALLOW ALL inbound/outbound

SGs vs ACLs

SG	ACL
INSTANCE level	SUBNET level
ALLOW rules only	ALLOW & DENY rules
STATEFUL (return traffic autom. allowed)	STATELESS (return traffic must be explicitly allowed)
ALL rules evaluated BEFORE deciding to allow	Rules processed in NUMBERED ORDER
Applied SELECTIVELY to individual instances	AUTOM. APPLIED to ALL instances w/in a SUBNET (backup layer of defense)
To ALLOW specific traffic	To DENY between subnets

Flow Logs

Use Cases	Enable to capture information about the traffic going to and from network interfaces in the VPC Log data is stored using CloudWatch Logs Flow logs can be created at 3 levels: VPC, subnet, network interface
Limitations	Not possible to enable flow logs for VPCs that are peered with your VPC unless the peer VPC is in your account You cannot tag a flow log After you've created a flow log, you cannot change its configuration (i.e., you cannot associate a different IAM role with the flow log)
Not all traffic is monitored	Traffic generated by instances when they contact the Amazon DNS server (DNS traffic is logged if you use your own DNS server) Traffic generated by a Windows instance for Amazon Windows license activation Traffic to and from 169.254.169.254 for instance metadata DHCP traffic Traffic to the reserved IP address for the default VPC router