> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/aws-saa-c02/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/aws-saa-c02/virtual-private-cloud-vpc/nacls-vs-security-groups.md).

# NACLs vs Security Groups

| Security group                                                                                                                                                                                  | Network ACL                                                                                                                                                                                                               |
| ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| <ul><li>At the <strong>instance level</strong>.</li></ul>                                                                                                                                       | <ul><li>At the <strong>subnet level</strong></li></ul>                                                                                                                                                                    |
| <ul><li>Only <strong>allow rules</strong>.</li></ul>                                                                                                                                            | <ul><li><strong>Allow rules and deny rules</strong>.</li></ul>                                                                                                                                                            |
| <ul><li><strong>Stateful - Return traffic is automatically allowed</strong>, regardless of any rules.</li></ul>                                                                                 | <ul><li><strong>Stateless - Return traffic must be explicitly allowed</strong> by rules.</li></ul>                                                                                                                        |
| <ul><li><strong>AWS evaluate all rules</strong> before deciding whether to allow traffic.</li></ul>                                                                                             | <ul><li><strong>AWS process rules in order</strong>, starting with the lowest numbered rule, when deciding whether to allow traffic</li></ul>                                                                             |
| <ul><li><strong>Applies to an instance only if someone specifies the security group</strong> when launching the instance, or associates the security group with the instance later on</li></ul> | <ul><li><strong>Automatically applies to all instances in the subnets that it's associated with</strong> (therefore, it provides an additional layer of defense if the security group rules are too permissive)</li></ul> |