AWS VPC Deep Dive Part 2: NAT Instances, VPC Flow Logs, Security Groups, NACLs, and VPC Endpoints.
Continue exploring AWS VPC networking with a practical explanation of NAT Instances, VPC Flow Logs, Security Groups vs. Network ACLs, and Gateway vs. Interface Endpoints.
Series: AWS VPC (2 articles)
- 2AWS VPC Deep Dive Part 2: NAT Instances, VPC Flow Logs, Security Groups, NACLs, and VPC Endpoints. This article
AWS VPC Deep Dive Part 2: NAT Instances, VPC Flow Logs, Security Groups, NACLs, and VPC Endpoints
Introduction
In my previous article, AWS VPC Deep Dive Part 1: IGW, NAT Gateway, VPN, Peering, and Endpoints , I covered the fundamentals of AWS VPC networking, including Internet Gateways, NAT Gateways, VPNs, VPC Peering, Transit Gateway, and VPC Endpoints.
In this article, we will continue exploring AWS VPC networking by focusing on NAT Instances, VPC Flow Logs, Security Groups, Network Access Control Lists (NACLs), and the two main types of VPC Endpoints: Gateway Endpoints and Interface Endpoints.
These components help us manage outbound connectivity, monitor network traffic, control access, and privately connect to supported AWS services.
Let's understand each concept in simple terms.
1. NAT Instance
A NAT Instance is an EC2 instance configured to perform Network Address Translation (NAT). It provides a way for resources in private subnets to initiate connections to external destinations without requiring those resources to have direct inbound internet connectivity.
Think of a NAT Instance as a server that acts as a middleman between resources in a private subnet and external networks.
NAT Instance vs. NAT Gateway
A NAT Gateway is an AWS-managed service that provides outbound internet connectivity to private subnets. A NAT Instance is an EC2 instance configured to perform the same function.
The key difference is who manages the infrastructure.
- NAT Gateway: AWS manages the underlying infrastructure and service availability.
- NAT Instance: We manage the EC2 instance, including its operating system, updates, configuration, scaling, and high availability.
NAT Gateways reduce operational overhead and are generally preferred for production environments, while NAT Instances offer more control but require us to manage patching, scaling, security, and high availability.
Security Groups and NAT Instances
NAT Gateways do not support Security Groups being attached directly to them.
NAT Instances can use Security Groups because they are EC2 instances with network interfaces.
This gives us more control over the traffic permitted to and from the instance. However, we must configure the instance correctly for forwarding traffic, including disabling its source/destination check where required.
When would we use a NAT Instance?
NAT Instances can be useful when we need more control over the underlying instance or want to implement a custom networking configuration.
However, we must account for instance capacity, operating system maintenance, monitoring, failover, and other operational responsibilities. For most standard production workloads, a NAT Gateway is generally the simpler choice.
2. VPC Flow Logs
Imagine an EC2 instance in a private subnet cannot connect to another resource. How would we investigate whether traffic was accepted or rejected at the network level?
This is where VPC Flow Logs become useful.
VPC Flow Logs are like network activity records. They help us understand which network traffic was observed, including traffic that was accepted or rejected.
VPC Flow Logs capture metadata about IP traffic going to and from supported VPC network interfaces. They help us troubleshoot connectivity issues, investigate rejected traffic, and understand network patterns.
Where can we create Flow Logs?
We can create Flow Logs for:
- VPC: To capture traffic information across the VPC's supported network interfaces.
- Subnet: To capture traffic information associated with network interfaces in a particular subnet.
- Network Interface: To focus on traffic associated with a specific network interface.
Where are Flow Logs stored?
Flow Logs can publish data to destinations such as:
- Amazon CloudWatch Logs
- Amazon S3
- Amazon Data Firehose
The destination depends on the configuration.
Why are VPC Flow Logs useful?
- Troubleshooting connectivity issues.
- Investigating accepted and rejected traffic.
- Understanding network traffic patterns.
- Supporting security investigations and network monitoring.
Important: VPC Flow Logs record metadata about network traffic. They do not capture the actual contents of network packets, and they do not replace Security Groups or NACLs.
3. Security Groups
A Security Group acts like a virtual firewall attached to supported AWS resources, such as EC2 instances and network interfaces. It controls which traffic is allowed in and out.
In simple terms, a Security Group acts as a virtual firewall for a resource's network interface.
Security Groups are stateful. Why?
A Security Group is stateful because it tracks connections and automatically permits response traffic for an allowed connection.
For example, suppose a user accesses a web server over HTTPS on port 443.
- The inbound request is allowed by the Security Group.
- The connection is tracked.
- The web server sends a response to the user.
- The response traffic is automatically permitted by the Security Group, even if there is no explicit outbound rule allowing that response.
Unlike stateless firewalls, such as AWS Network ACLs, we do not need to configure matching rules for both directions of the same established conversation.
This stateful behavior makes Security Groups easier to manage for many application workloads.
Key characteristics of Security Groups
- They are associated with supported resources and network interfaces.
- They control inbound and outbound traffic.
- They are stateful.
- They support allow rules but do not have explicit deny rules.
- Response traffic for an allowed connection is automatically permitted.
A Security Group is a stateful virtual firewall that controls inbound and outbound traffic for supported resources. It allows traffic based on configured rules, and response traffic for an allowed connection is automatically permitted.
4. Network Access Control Lists (NACLs)
A Network Access Control List (NACL) is a network-level firewall associated with a subnet.
While Security Groups control traffic at the resource's network interface, NACLs control traffic entering and leaving the subnet.
Key characteristics of NACLs
- They are associated with subnets.
- They support both allow and deny rules.
- They are stateless.
- They evaluate inbound and outbound traffic separately.
- Rules are evaluated in ascending numerical order, and the first matching rule determines the result.
NACLs are stateless. Why?
A NACL is stateless because it does not track connections or remember whether an incoming request was previously allowed.
It evaluates each packet independently against the applicable inbound or outbound rules.
For example, suppose a user sends an HTTPS request to a web server on port 443.
- The inbound NACL rule allows the request on port 443.
- The web server processes the request.
- The server attempts to send a response to the user.
- The outbound NACL evaluates the response independently.
- If the required outbound rule does not allow the response traffic, the response can be blocked.
The NACL does not automatically allow response traffic simply because the original request was permitted.
Therefore, we must configure both inbound and outbound NACL rules, including the necessary return traffic and ephemeral ports where applicable.
This is the main reason NACLs require more careful rule configuration than Security Groups.
5. Security Groups vs. NACLs
Both Security Groups and NACLs control network traffic in AWS, but they operate at different levels and behave differently.
| Feature | Security Group | NACL |
|---|---|---|
| Association | Supported resources/network interfaces | Subnets |
| Stateful or stateless | Stateful | Stateless |
| Rules supported | Allow rules | Allow and deny rules |
| Rule evaluation | All applicable rules are considered | Rules evaluated in ascending numerical order; first match applies |
| Return traffic | Automatically permitted for tracked connections | Must be explicitly allowed by applicable rules |
| Primary purpose | Control traffic to and from resources | Control traffic entering and leaving subnets |
When should we use them?
Security Groups are commonly used to control which resources can communicate with an application or server.
NACLs can provide an additional layer of subnet-level traffic filtering, including explicit deny rules.
They complement each other and are not replacements for one another.
6. VPC Endpoints: Gateway Endpoint vs. Interface Endpoint
In my previous article, I introduced VPC Endpoints and explained how they provide private connectivity to supported AWS services.
Here, let's focus on the two endpoint types and understand how they differ.
A VPC Endpoint allows resources in a VPC to access supported AWS services or endpoint services through a private connectivity mechanism, depending on the endpoint type and configuration.
VPC Endpoints can reduce the need to route specific service traffic through a NAT Gateway or Internet Gateway.
6.1 Gateway Endpoint
A Gateway Endpoint allows resources in a VPC to access Amazon S3 or DynamoDB privately through route-table configuration.
It avoids sending that service traffic through a NAT Gateway or Internet Gateway, and there is no additional charge for the Gateway Endpoint itself.
Key characteristics:
- Supports Amazon S3 and Amazon DynamoDB.
- Uses route-table entries to direct traffic to the endpoint.
- Does not create endpoint network interfaces in your subnets.
- Has no additional charge for the Gateway Endpoint itself.
- Requires appropriate routing and service permissions.
For example, an EC2 instance in a private subnet needs to access an S3 bucket containing application files.
Instead of routing that S3 traffic through a NAT Gateway, we can configure a Gateway Endpoint and associate it with the appropriate route tables.
The instance can then access S3 through the endpoint, subject to the applicable routing and authorization configuration.
6.2 Interface Endpoint
An Interface Endpoint uses AWS PrivateLink and creates private network interfaces in selected subnets. These interfaces provide private IP addresses through which resources can connect to supported AWS services.
Key characteristics:
- Uses AWS PrivateLink.
- Creates endpoint network interfaces in selected subnets.
- Provides private IP addresses for service connectivity.
- Supports many AWS services, as well as supported endpoint services offered by other parties.
- Generally incurs charges for endpoint usage and data processing.
For example, an EC2 instance in a private subnet needs to communicate with a supported AWS service.
We can create an Interface Endpoint in the appropriate subnet and configure the associated Security Groups, DNS, routing, and service permissions as required.
The resource can then connect through the endpoint's private network interfaces without needing a general internet route for that service traffic.
Gateway Endpoint vs. Interface Endpoint
| Feature | Gateway Endpoint | Interface Endpoint |
|---|---|---|
| Connectivity mechanism | Route-table entries | Private network interfaces |
| Supported services | Amazon S3 and DynamoDB | Many supported AWS services and endpoint services |
| Uses AWS PrivateLink | No | Yes |
| Creates endpoint network interfaces | No | Yes |
| Security Groups | Not attached to the endpoint | Can be associated with endpoint network interfaces |
| Additional endpoint charge | No additional charge for the endpoint itself | Generally charged |
| Common use case | Private access to S3 or DynamoDB | Private access to supported services through PrivateLink |
Which one should we choose?
If we need private connectivity to Amazon S3 or DynamoDB, a Gateway Endpoint is often a straightforward and cost-effective choice.
If we need private connectivity to another supported AWS service or a supported endpoint service, an Interface Endpoint may be appropriate.
The right choice depends on the service being accessed, the networking requirements, and the desired security configuration.
Important: A VPC Endpoint provides connectivity, not automatic authorization. IAM policies, endpoint policies where applicable, and service-specific permissions still determine what access is allowed.
7. Final Summary
Let's quickly revise the concepts covered in this article.
| Component | Primary purpose |
|---|---|
| NAT Instance | An EC2 instance configured to provide NAT for outbound connectivity |
| NAT Gateway | An AWS-managed service providing NAT connectivity |
| VPC Flow Logs | Records metadata about observed IP traffic for monitoring and troubleshooting |
| Security Group | A stateful firewall for supported resources and network interfaces |
| NACL | A stateless firewall associated with a subnet |
| Gateway Endpoint | Private connectivity to Amazon S3 or DynamoDB through route tables |
| Interface Endpoint | Private connectivity through network interfaces using AWS PrivateLink |
Series: AWS VPC (2 articles)
- 2AWS VPC Deep Dive Part 2: NAT Instances, VPC Flow Logs, Security Groups, NACLs, and VPC Endpoints. This article
Enjoyed reading this content? Let the author know!
Your likes, comments, shares, and saves help creators reach more builders.
Loading recommendations
Loading article