Network ACLs filter traffic at the subnet boundary. They add a second layer beyond security groups.
Characteristics:
- Stateless: Allow both directions explicitly
- Rules evaluated in order by number
- First match applies, then stops
- Default NACL allows all
Stateless example: Allow inbound HTTP on port ? You must also allow outbound on ephemeral ports (-) for responses.
When to use:
- Blocking specific IP ranges
- Adding deny rules (security groups cannot deny)
- Compliance requirements
Most architectures rely on security groups. NACLs add defense for high-security environments.