Network Security In AWS - Basics
Published: 2021-07-25 15:39:04

**Amazon Virtual Private Cloud (Amazon VPC)**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wl3l55po0dvbebrctjip.jpg)

**_Amazon VPC_** is a networking service that users can use to establish boundaries around their AWS resources. 

Consider millions of users who use AWS. Imagine the millions of resources that these users have created such as Amazon EC2 instances. Without boundaries across all these resources, there would be an unrestricted network traffic flowing between these resources.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bso4m4uld1h2f2lmw7lj.png)

By using _Amazon VPC_, users can provision an isolated section in the AWS Cloud so that they can launch resources in a virtual network that they define.



**Subnets**

**_Subnet_** is a section of a VPC in which users can group resources based on security or operational needs. 

_Subnets_ are of two types as follows:
1. **_Public Subnet_** - These contain resources that need to be accessible by the public.
2. **_Private Subnet_** - These contain resources that should be accessible only through user's private network.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vx38yrkw0w86wiyafovk.png)

_In a VPC, subnets can communicate with one other_. It means that Public subnet can send or receive data from Private subnet and vice versa.


**Internet Gateway**

An **_Internet Gateway_** is a connection between a VPC and the internet. To allow public traffic from the internet to access  VPC, users attach an _Internet Gateway_ to the VPC. Without an _Internet Gateway_, no one can access the resources within your VPC.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eo1rtd1g5fbjaw7wcy36.png)


**Virtual Private Gateway**

What if users have a VPC that includes only private resources? 
To access private resources in a VPC, users can use a **_Virtual Private Gateway_**.

_Virtual Private Gateway_ only allows protected internet traffic (data coming from an approved network) to enter into the VPC. It establishes a _Virtual Private Network (VPN)_ connection between  VPC and a private network, such as an on-premises data center.

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jhrmabzmge43s6f6gesb.png)


**AWS Direct Connect**

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jxhqm0lxg12y5jpf949z.jpg)

**_AWS Direct Connect_** is a service that establishes a dedicated private connection between on-premises data center and a VPC. It helps to reduce network costs and increase the amount of bandwidth that can travel through the private network.  

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fnx46oya06mmjfmt3qzp.png)


**Network Access Control Lists (ACLs)**

**_Network Access Control List (ACL)_** is a virtual firewall that controls inbound and outbound traffic at the subnet level. 

Every AWS account includes a default _Network ACL_. By default, AWS account’s default _Network ACL_ allows all inbound and outbound traffic, but it can be modified by adding own rules. For custom _Network ACLs_, all inbound and outbound traffic is denied until rules are added to specify which traffic to allow. Additionally, all _Network ACLs_ have an explicit deny rule. This rule ensures that if a packet doesn’t match any of the other rules on the list, the packet is denied. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/err4xp10e2q2ig1xh9vp.png)

_Network ACLs_ perform **_stateless packet filtering_**. They don't remember anything and check packets that cross the subnet  each way: inbound and outbound.

**Example** - In the airport, travelers are trying to enter into a different country. Think of the travelers as packets and the passport officer as a Network ACL. The passport officer checks travelers ID proof when they are both entering and exiting out of the country. If a traveler is on an approved list, they are able to get through. However, if they are not on the approved list, they cannot come in. 

Similarly, consider a request is send out from an Amazon EC2 instance to the internet. When a response for that request comes back to the subnet, the Network ACL does not remember the previous request. The network ACL checks the response against its list of rules to determine whether to allow or deny.


**Security Groups**

**_Security Group_** is a virtual firewall that controls inbound and outbound traffic for an Amazon EC2 instance.

By default, a _Security Group_ denies all inbound traffic and allows all outbound traffic. Users can add custom rules to configure which traffic to allow or deny. If there are multiple instances within a subnet, they can be associated with the same _Security Group_ or use different _Security Groups_ for each instance. 

![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ooqm1s01eiawgx89i2qv.png)

_Security Groups_ perform **_stateful packet filtering_**. They remember previous decisions made for incoming packets.

**Example** - Consider a building with a door attendant who greets the incoming guests. Think of the guests as packets and the door attendant as a Security Group. As guests arrive, the door attendant checks a list to confirm they can enter the building. However, the door attendant does not check the list again when guests are exiting the building.

Similarly, consider a request is send out from an Amazon EC2 instance to the internet. When a response for that request returns back to the instance, the _Security Group_ remembers your previous request. The security group allows the response to proceed, without checking the inbound security group rules.


![Alt Text](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3r461prvrh0cywb2bk7f.png)


Please feel free to write @ rewooparth.rp@gmail.com for any queries on Network Security in AWS - Basics & stay tuned for next write-up.

Thank you!