‫So now that we've seen all the aspect
‫about defining the network in our VPC
‫let's talk about this network security.
‫So let's talk about the concept
‫of network ACL and security groups.
‫So we're back in our VPC.
‫It has 1 public subnet and 1 EC2 instance in it.
‫We can create a NACL or network ACL.
‫Which is a firewall that controls traffic
‫from and to the subnets.
‫And this can have allow and deny rules.
‫So we can allow traffic or deny traffic.
‫And that's explicit.
‫You attach these NACL's at the subnet level
‫and the rules only include IP addresses.
‫So you're saying, Hey all the traffic coming
‫from this IP address is allowed, or all the traffic coming
‫from these IP addresses are denied, and so on.
‫So the NACL is here and it is the first mechanism of defense
‫of our public subnets, and it's at the subnet level.
‫So as we can see the traffic coming
‫to and from the internet is going to go first
‫through the network ACL.
‫But it hasn't reached our EC2 instance just yet.
‫Next we have security groups and we've seen them
‫already in this course.
‫So security groups is a firewall that controls traffic
‫to and from an ENI so elastic network interface or
‫an EC2 instance.
‫In this security groups as we've seen can only have
‫the allow rules and they can reference
‫either IP addresses or other security groups.
‫And this is something we have seen already in this course.
‫So we attach a security group to our EC2 instance
‫and now the traffic can flow all the way
‫through to our EC2 instance.
‫And we have the second mechanism of defense.
‫So we've seen security groups at depth in this course
‫but we haven't really touched NACL's.
‫Why? Because when you have a default VPC
‫the default NACL allows everything in and
‫allows everything out.
‫And this is why we haven't had to change the network ACL
‫in this course and we will not do any hands-on on it either.
‫But just know that before the internet traffic
‫reaches your EC2 instance it has to go
‫through this network ACL
‫which acts as a firewall.
‫So they're very different
‫than network SCL and the security Group.
‫And there is a table that summarizes it.
‫You don't need to remember it.
‫This is more something for
‫the Solutions Architect Associate
‫or the certified Sysap's Associate.
‫But the idea is that the security group is attached
‫to an instance or an ENI
‫whereas the network ACL is at the subnet level.
‫The Security Group is only allow rules whereas
‫for network ACL it's allow and deny rules.
‫Is stateful, so that means any traffic that comes
‫that return traffic is automatically allowed regardless
‫of any roles.
‫Whereas here for the network ACL
‫you need to allow the traffic in and out.
‫And here you can look at the rest
‫but this is pretty irrelevant for the certification.
‫Okay, so this is just if you're curious.
‫So now that we have all this traffic flowing
‫through our VPC, through the network ACL
‫and the security groups, we're curious about
‫can we get a information
‫about all this traffic flowing through?
‫Can we get a log from it?
‫And this is called a VPC flow log.
‫So this is going to capture information
‫about all the IP traffic going into your interfaces.
‫That includes the VPC flow logs, the Subnet flow logs
‫and the ENI flow logs
‫or Elastic Network Interface flow logs.
‫So anytime you have network going through your VPC
‫it will be logged in a flow log.
‫And so this is to help you monitor
‫and troubleshoot connectivity issues.
‫For example, if you want to know why your subnet cannot
‫access the internet or why a subnet can talk or
‫cannot talk to another subnets or internet to subnet
‫et cetera, et cetera.
‫So anytime you have a network issue and you need
‫to be able to troubleshoot it, you need to look
‫at the VPC flow logs because they will give you everything.
‫All the information around
‫the allowed and the denied traffic.
‫It will capture network information as well from
‫anything that is managed by AWS.
‫So the Elastic Load Balancers, your ElastiCache, RDS, Aurora
‫all this will appear in your VPC flow logs.
‫So in case of connectivity issues
‫you can look there right away
‫And the VPC flow logs data can be sent to Amazon S3
‫it can be sent to CloudWatch Logs and Kinesis Data Firehose
‫so you can send it to many places in AWS.
‫So that's it for this lecture.
‫I hope you liked it.
‫We've seen NACL's, security groups
‫and VPC flow logs and I will see you and the next lecture.