AWS Network Security Components: Defense in Depth

This study guide covers the essential network security components required for the AWS Certified DevOps Engineer - Professional (DOP-C02) exam, focusing on automating security controls and implementing layered protection.

Learning Objectives

• Differentiate between stateful and stateless filtering mechanisms (Security Groups vs. Network ACLs).
• Architect multi-layered security using AWS WAF, AWS Shield, and AWS Network Firewall.
• Implement automated security controls for traffic filtering and routing in multi-account environments.
• Understand the role of Intrusion Detection and Prevention Systems (IDS/IPS) in the cloud.

Key Terms & Glossary

• Stateful Filtering: A firewall that tracks the state of active connections and automatically allows return traffic. (Example: Security Groups).
• Stateless Filtering: A firewall that treats each packet as an isolated unit; return traffic must be explicitly allowed. (Example: Network ACLs).
• IDS/IPS (Intrusion Detection/Prevention System): Tools that monitor network traffic for malicious activity and can take action to block it. (Example: AWS Network Firewall).
• DDoS (Distributed Denial of Service): An attempt to make an online service unavailable by overwhelming it with traffic from multiple sources. (Example protected by: AWS Shield).
• WAF (Web Application Firewall): A firewall that monitors and filters HTTP/S traffic to protect web applications from common exploits like SQL injection. (Example: AWS WAF).

The "Big Idea"

The core philosophy of AWS Network Security is Defense in Depth. No single tool is a "silver bullet." Instead, security is achieved by layering controls at the edge (CloudFront/WAF/Shield), the network perimeter (Network Firewall/Routing), and the resource level (Security Groups). This ensures that if one layer is compromised, others remain to protect the data.

Formula / Concept Box

Hierarchical Outline

• I. Host-Level Security
  • Security Groups (SG)
    • Stateful: Automatically allows response traffic.
    • Rules: Allow-only (implicit deny).
    • Evaluation: All rules are evaluated before traffic is allowed.
• II. Subnet-Level Security
  • Network Access Control Lists (NACL)
    • Stateless: Requires separate inbound/outbound rules.
    • Rules: Support Allow and Deny.
    • Evaluation: Processed in numbered order (lowest first).
• III. VPC Perimeter & Inter-VPC Security
  • AWS Network Firewall
    • Managed IDS/IPS capabilities.
    • Fine-grained filtering for outbound (egress) traffic (FQDN filtering).
    • Deep packet inspection for VPC-to-VPC traffic.
• IV. Edge & Application Security
  • AWS WAF: Protections against SQLi, XSS, and bot scrapers.
  • AWS Shield: Standard (free) vs. Advanced (paid DDoS protection with specialized support).

Visual Anchors

Traffic Flow Inspection

VPC Layering

Definition-Example Pairs

• FQDN Filtering: Restricting outbound traffic to specific domain names rather than just IP addresses.
  • Example: A DevOps engineer uses AWS Network Firewall to ensure that internal servers can only reach *.updates.microsoft.com and github.com for patches, blocking all other internet-bound traffic.
• WAF Rule Groups: Pre-configured sets of rules (managed by AWS or partners) to block common threats.
  • Example: Enabling the "Core Rule Set" (CRS) in AWS WAF to automatically block common OWASP Top 10 vulnerabilities like Shellshock or SQL injection without writing custom regex.

Worked Examples

Scenario: Securing a High-Traffic API

Problem: An API hosted on an Application Load Balancer (ALB) is being targeted by a distributed botnet performing credential stuffing.

Step-by-Step Solution:

1. Deploy AWS WAF: Associate a Web ACL with the ALB.
2. Enable Rate-based Rules: Set a threshold (e.g., 100 requests per 5 minutes per IP) to slow down the botnet.
3. Implement Managed Rules: Add the "Anonymous IP list" and "Known bad inputs" rule groups from AWS Managed Rules.
4. AWS Shield Advanced: Subscribe to Shield Advanced for higher-level DDoS protection and access to the Shield Response Team (SRT).

Checkpoint Questions

1. Why would you use a Network ACL to block a specific IP address instead of a Security Group?
2. Which service would you use to perform deep packet inspection for traffic moving between two different VPCs connected via Transit Gateway?
3. If a Security Group has an inbound rule allowing port 80, but the NACL has no outbound rules, will the web server be able to respond to requests? Why or why not?

Muddy Points & Cross-Refs

• SG vs. NACL: This is a classic exam trap. Remember: SG = Resource level/Stateful; NACL = Subnet level/Stateless. If you block an IP in an SG, it only affects that resource. If you block it in a NACL, it affects everything in that subnet.
• WAF vs. Network Firewall: WAF is Layer 7 (HTTP/S) only. Network Firewall can handle Layer 3-7 and is used for non-web protocols (like SSH, SFTP, or general outbound traffic).
• Shield Standard vs. Advanced: Standard is automatic and free (Layer 3/4). Advanced provides Layer 7 protection, cost protection (bill credits for scaling during an attack), and 24/7 expert support.

Comparison Tables

Security Groups vs. Network ACLs

AWS WAF vs. AWS Network Firewall