Allow HTTPS traffic to an EC2 instance.
Avoid adding separate rules for the return traffic of each connection.
Which control is most appropriate?
Use a security group for stateful instance-level filtering so return traffic for an allowed connection is tracked automatically.
Detailed explanation
Security groups are stateful and automatically allow return traffic for an allowed connection.
Security groups are stateful and automatically allow return traffic for an allowed connection.
A stateless NACL needs separate return rules and does not meet the requirement.
A stateless NACL needs separate return rules and does not meet the requirement.
An S3 policy does not filter packets to an EC2 instance.
An S3 policy does not filter packets to an EC2 instance.
A DNS health check does not permit or deny packets.
A DNS health check does not permit or deny packets.
Check official documentation
Compare the following points with the official documentation.
VPC security groupとnetwork ACLの公式比較を確認する。
What to confirm
Security Groupのステートフル性とNACLのステートレス性を区別できる。
Key points
- Security group
- Stateful
- Network ACL
Notes
- Environment: AWS公式VPCドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Connection state
Security groups remember connection state, while NACL directions are evaluated separately.
Resource scope
The selected control should match the EC2 interface-level requirement.