Explicitly deny traffic from a source CIDR to a subnet.
Design return rules as well because the boundary control is stateless.
Which feature is most appropriate?
Add a numbered deny rule to the subnet's Network ACL.
Detailed explanation
Deleting a DNS record does not reject existing IP packets.
Deleting a DNS record does not reject existing IP packets.
Web-request inspection does not deny all subnet traffic from a CIDR.
Web-request inspection does not deny all subnet traffic from a CIDR.
Security groups are stateful allow controls and do not support deny rules.
Security groups are stateful allow controls and do not support deny rules.
A Network ACL controls CIDRs and ports at the subnet boundary and supports explicit deny rules.
A Network ACL controls CIDRs and ports at the subnet boundary and supports explicit deny rules.
Check official documentation
Compare the following points with the official documentation.
VPC network ACL stateless rulesの公式説明を確認する。
What to confirm
NACLのdenyとSecurity Groupの許可型ルールを区別できる。
Key points
- Network ACL
- Deny rule
- Stateless
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Boundary control
A NACL applies to subnet traffic, while a security group applies to an interface and allows only.
Rule order
Numbered NACL rules are evaluated in order, so a specific deny must be placed appropriately.