Security Components, Resources, and Services (Task 2.4)

AWS Security Components and Resources

Source: https://docs.aws.amazon.com/whitepapers/latest/aws-overview/security-and-compliance-model.html

Network security on AWS is a layered system: NACLs at the subnet, security groups at the instance, WAF at the application, Shield at the edge. The exam tests the SG vs NACL contrast constantly; senior engineers use the SG-referencing pattern to build tiers that cannot be bypassed.

Security Groups — the primary firewall

Brief: A stateful, instance-level (technically ENI-level) firewall that allows traffic. The default workhorse of AWS network security.

How it works: An SG holds ALLOW rules only (source/destination + protocol + port) — anything not allowed is implicitly denied. Stateful means return traffic is automatically permitted: an inbound HTTPS rule allows the request in AND the response out, regardless of outbound rules. All rules are evaluated as a set — there is no rule order or priority. Rules can reference other security groups instead of CIDRs: "allow 3306 from web-sg" means only instances carrying web-sg may connect — even across tiers, and the rule tracks membership dynamically.

Example: Default SG behavior: deny all inbound, allow all outbound. A web server needs one inbound rule (443 from 0.0.0.0/0) and nothing else — responses flow back automatically because of state.

Real use-case: A company's database SG allows 3306 ONLY from web-sg. A developer launches a "temporary" debug instance in the database subnet with a different SG — it cannot reach the database at all. The tier pattern enforced itself without any human review.

Gotchas & interview notes: allow-only (there is NO deny rule — the exam loves this); stateful (never write return-traffic rules); changes apply immediately to all attached ENIs; an SG attached to an ALB can be referenced by instances behind it ("allow from alb-sg") — this is how you make instances unreachable except through the load balancer.

Network ACLs — the subnet safety net

Brief: A stateless, subnet-level firewall with numbered, ordered rules that support BOTH allow and deny.

How it works: Every subnet has exactly one NACL. Rules are numbered (1–32766) and evaluated in ascending order — FIRST match wins, then evaluation stops. Stateless means return traffic is NOT remembered: allowing inbound HTTPS on a custom NACL also requires allowing outbound ephemeral ports (1024–65535), because the server's response uses a random high port.

Example: Rule #100 DENY the attacker's IP range, rule #200 ALLOW 443 from anywhere. The deny at the lower number executes first — the attacker is blocked regardless of any later allow.

Real use-case: A scraper's /16 keeps hammering a public subnet. The team adds one DENY rule on the subnet NACL (#50) — every instance in the subnet is protected instantly, no SG changes across 40 instances needed.

Gotchas & interview notes: stateless + ephemeral ports is THE NACL gotcha; default NACL allows everything (which is why many architectures never touch it — SGs do the work); custom NACLs deny all until you add rules; use NACLs for broad stateless blocks (bad IP ranges), SGs for precise instance access.

AWS WAF — Layer 7 protection

Brief: A web application firewall protecting HTTP/HTTPS apps from SQL injection, XSS, bots, and rate abuse — attaches to CloudFront, ALB, API Gateway, AppSync, or Cognito.

How it works: A Web ACL (ordered rule groups) evaluates request properties: IP, geography, headers, URI, query strings, body (first 8 KB), and rate per client IP. Actions: allow, block, or count (count = shadow mode for testing rules safely). Managed rule groups cover the OWASP Top 10 without writing regex.

Real use-case: A checkout API receives credential-stuffing traffic from 10,000 IPs. A rate-based rule (2,000 req/5 min per IP) plus a managed rule blocking anonymizer ranges cuts fraudulent logins 94% — deployed in count mode first to prove no real users were affected, then switched to block.

Gotchas & interview notes: WAF is Layer 7 ONLY — SGs/NACLs (Layer 3/4) cannot see inside an HTTPS body, and WAF cannot block a port scan. CloudFront + WAF is the classic pairing for public apps (attacks are absorbed at the edge, never reach your origin).

Third-Party Security Products — AWS Marketplace

Brief: A digital catalog of thousands of third-party software offerings — security appliances (Palo Alto, Fortinet firewalls), IDS/IPS, endpoint protection — deployable as AMIs, SaaS, or professional services.

Exam pattern: "Where do you find third-party security software?" → AWS Marketplace. Vendors with the AWS Security Competency are pre-vetted; billing consolidates into your AWS invoice.

Free AWS Security Information Resources

These are free, current, and the exam's answer for "where to learn about security best practices" — along with the documentation itself.

AWS Trusted Advisor

Brief: Automated account inspections across five categories: cost optimization, performance, security, fault tolerance, and service quotas.

How it works: Trusted Advisor continuously evaluates your account against best practices: is MFA on root? Are IAM keys older than 90 days? Is any S3 bucket public? Is any security group open to 0.0.0.0/0 on port 22? Core checks are free to all accounts; the full set requires Business/Enterprise support.

Real use-case: A weekly Trusted Advisor review catches a hastily-opened port 22 rule (from a debugging session nobody closed) before it becomes a finding in the annual penetration test.

Gotchas & interview notes: Trusted Advisor = account-level best-practice INSPECTION (tells you what is wrong); it does not fix things automatically — that remediation pattern is AWS Config rules with auto-remediate, or Security Hub + EventBridge + Lambda.

Worked Example: Layered VPC Security (Defense in Depth)

A three-tier web app in a VPC:

• NACL on the public subnet denies a known attacker IP range outright (rule #100 DENY) — the coarse outer layer.
• Security group alb-sg allows 443 from 0.0.0.0/0 (internet users).
• Security group web-sg allows 80/443 only from alb-sg — direct internet access to web instances is impossible, even for someone who knows their IPs.
• Security group db-sg allows 3306 only from web-sg — the database cannot be reached from anywhere else in the VPC, by design.
• WAF on the ALB blocks SQL injection and known bot signatures — the application layer.
• Shield Standard absorbs volumetric DDoS at the edge — the network layer.
• Trusted Advisor (weekly check) flags if any of these groups is opened to the world by a hasty change — the governance layer.

Notice the pattern: every tier references the security group of the tier above — least privilege applied to networking. Each layer assumes the layer above it can fail: WAF misses a novel attack? The SG tiering still contains it. SG rule too permissive? The WAF still inspects the request. That is defense in depth — no single control is trusted alone.