How to Create/Modify NACLs and SGs in AWS

In AWS, Network Access Control Lists (NACLs) and Security Groups (SGs) are used to control traffic to and from your resource, much like a firewall. It’s also called Inbound and Outbound rules.  But they serve slightly different purposes. NACLs operate at the subnet level and control traffic entering or leaving the subnet, while SGs operate at the instance level and control inbound and outbound traffic for instances.

Network Access Control Lists (NACLs) and Security Groups (SGs) play a pivotal role in controlling network traffic for your cloud resources. Let’s explore the process of creating and modifying NACLs and SGs, along with real-life examples.

Related: How to Configure User-Defined Routes in AWS

Creating NACL in AWS

Sign in to your AWS account and access the AWS Management Console.

Search “VPC” in the search bar.

Navigate to the VPC Dashboard.

In the VPC Dashboard, choose “Network ACLs” from the left sidebar (It’s under Security).

Click the “Create Network ACL” button.

Provide a name for your NACL and choose the associated VPC.

Related: How to Create a VPC on AWS Step-by-Step

Click “Create” to create the new NACL.

Example:

• Name: MyNACL 
• VPC: Select your target VPC (It’s the VPC to which the NACL will be associated) 

Modifying NACL in AWS

Modifying NACL rules allows you to customize traffic flow within your VPC’s subnets. Here’s how you can modify an existing NACL:

Select the NACL you want to modify.

Go to the “Inbound Rules” tab to modify or delete inbound rules.

Click the “Edit inbound rules” button to make changes to the inbound  rules.

To add a new rule, click the “Add Rule” button.

For this example, we are now editing the rule which allows all HTTP traffic:

• Rule: Rule number can be anything
• Protocol: TCP
• Port Range: 80 (HTTP)
• Source: 0.0.0.0/0 
• Allow/Deny: Allow
• Explanation: This rule allows incoming HTTP traffic from any destination, commonly used for web applications and websites. You can restrict the source to a specific range of IP addresses to enhance security.

Now click on “Save Changes” then your inbound rules will be changed. 

To change the outbound rules. Go to the “Outbound Rules” tab to modify or delete outbound rules 

Click the “Edit outbound rules” button to change the rules.

To add a new rule, click the “Add Rule” button.

For this example, we are now editing the rule which allows all HTTPS traffic:

• Rule: Rule number can be anything
• Protocol: TCP
• Port Range: 443 (HTTP)
• Destination: 0.0.0.0/0 
• Allow/Deny: Allow
• Explanation: This rule allows outgoing HTTPS traffic to any destination. You can restrict the source to a specific range of IP addresses to enhance security.

Click “Save rules” to apply the changes.

Creating SGs in AWS

In the AWS Management Console, Search “EC2.”

In the right sidebar go to the “Security Groups” inside the Network & Security tab.

Click on a “Create Security Group.”

Give the name to the security group, write a description, and choose your desired VPC in which you are launching the EC2 instance.