Security to subnet and EC2 instances
- Security to EC2 instances (Network Interface) is provided using Security Groups
- Security to Subnet is Provided using Network ACL (NACL)
Security Group
- It is assigned to ENI
- In Security group by default everything is denied
- You can write rules to only allow
- Security Group rules are created at vpc level
- When we create a vpc a default security group is created
- Lets create one Security Group rule which allows 80 and 22 port from any one
- Protocols => TCP, UDP, ICMP
- PORTS
- TO WHOM => 0.0.0.0/0 (Anyone), x.x.x.x/32 (specific ip), x.x.0.0/16(cidr range)
- This sg can be applied to any ec2 instance created in the vpc
Network ACL (NACL)
- It is applied at subnet level
- Here you can create allow as well deny rules
- Rules will have priority associated with number, lower the number higher the priority
- NACL also belongs to VPC
- Lets create one nacl to allow 22,80,443 from internet, all traffic from with in vpc and deny rest of the traffic from internet
- Rules can be between 1 and 32766, It is always a good idea to leave some numbers b/w rules
- By Default AWS creates one default vpc with allow all incoming and outgoing rules
Exercise: Create the following network from CLI and Console
