Security Groups and NACLs

Network access within the example environment is controlled at two layers: security groups attached to individual resources, and network access control lists attached to subnets.

Security groups are scoped narrowly, typically allowing traffic only from a specific peer security group rather than from an entire CIDR range. For example, the database security group allows inbound traffic only from the application layer's security group, on the database port only.

Network ACLs provide a coarser, subnet-level backstop and are changed far less frequently than security groups. Any change to either should be reviewed against the current architecture diagram before being applied.