While creating a VPC, security is one of the most critical aspects of the VPN of an organization. As AWS states in many of its official communications, security of the customer network is one of its highest priorities. Keeping security at the top of the AWS charter, Amazon provides two features for taking care of network security and one feature for monitoring the network.
Security groups and NACLs are for network security and flow logs are for network monitoring. Security groups act as an EC2 instance-level firewall, whereas NACLs act as a subnet-level firewall. Flow logs provide insight into network traffic. In the following sections in this chapter, these features will be described in detail.
To start with, let's take a high-level overview of the difference between security groups and NACLs. The layers of communication, as shown in the following figure, help us to understand the significance of security groups and NACLs in a VPC:
Figure 4.15: Security groups and NACLs
Reference URL...