Explain the difference between Security Groups and NACLs in AWS.

Security Groups (Stateful):

• Virtual firewalls for EC2 instances
• Stateful: Return traffic automatically allowed
• Deny by default: Only allow rules, no explicit deny
• Instance-level: Applied to network interfaces
• Rule evaluation: All rules evaluated, most permissive wins

Network ACLs (Stateless):

• Subnet-level firewall
• Stateless: Must configure both inbound and outbound rules
• Allow and deny rules: Explicit allow/deny supported
• Subnet-level: Applied to all instances in subnet
• Rule evaluation: Rules processed in numerical order

Example:

• Security Group: Allow HTTPS (443) inbound → automatically allows response traffic
• NACL: Must explicitly allow both inbound 443 and outbound ephemeral ports (1024-65535)