Differences Between AWS Security Group, NACL, and IAM

Key takeaways:

• Security groups, NACLs, and IAM are key AWS security features.

• Security groups offer stateful instance-level traffic control with only allow rules.

• NACLs provide stateless subnet-level control with both allow and deny rules.

• IAM manages access permissions and policies for AWS services via JSON documents.

• Security groups evaluate rules collectively; NACLs use the lowest rule number for evaluation.

• NACLs and security groups manage traffic, while IAM defines user access to resources.

Security groups, Network Access List (NACL), and Identity and Access Management (IAM) are important security features in the AWS cloud. Security groups provide instance-level traffic control, NACL a subnet-level traffic control, and IAM defines policies for permitting or denying access to AWS services. 

Security group

A security group acts as a traffic filter, similar to a firewall, for instances in the cloud. It is used for instance-level traffic control and must be explicitly assigned to each instance. You can only define allow rules for both inbound and outbound traffic, not deny rules. Security groups are stateful, meaning that any outbound traffic corresponding to incoming traffic is automatically allowed without the need for you to define an outbound rule. The same applies to incoming traffic. A Virtual Private Cloud (VPC) comes with a default security group, but you can create additional security groups as needed. Any rule that is not explicitly allowed is denied by default.

The tables below provide examples of inbound and outbound traffic rules. Each table includes the rule name, protocol, port range, source/destination (depending on traffic direction), and a description.

The diagram below shows a cloud containing a public subnet with an Elastic Compute Cloud (EC2). This is accessible to users over the internet via the internet gateway. The EC2 instance is part of a security group to set inbound and outbound traffic rules.

NACL

Network access control lists (NACLs) provide similar functionality to security groups but operate at the subnet level. With NACLs, you can specify both allow and deny rules. Additionally, NACLs are stateless, meaning that for any allowed inbound rule, outbound traffic is permitted only if a corresponding rule exists. The rules are evaluated based on their numerical order, with the lowest number having the highest priority.

The following table shows examples of inbound and outbound rules. An entry with the rule number * is always given. This rule makes sure that any packet that does not match any rule is denied by default.

The following architecture diagram shows that a NACL has been applied to the public subnet.

Identity and access management (IAM)

Identity and Access Management (IAM) specifies who/what can access the AWS services/resources. IAM policies can be created to grant or deny users/user groups permanent or role-based access to AWS services. A policy is a JSON document specifying what permissions are granted or denied and for which users.

An example of a policy to provide read-only access for a S3 bucket would be as follows.

The following architecture diagram shows how various AWS account holders access AWS services based on IAM policies.

Differences between the three

The table below summarizes the key differences between the three.

Conclusion

In conclusion, NACL and security groups act as firewalls and manage traffic to and from resources at different levels. On the other hand, IAM defines policies for managing access to different AWS resources and services by account holders.