Which Security Features Are Within Amazon Virtual Private Cloud (VPC)
Amazon VPC provides a layered set of security features that let you control traffic at the instance, subnet, and network level. The key controls include security groups, network access control lists (ACLs), VPC flow logs, AWS Network Firewall, and encryption options for data in transit and at rest.
More from this site
Keep reading the latest coverage
Security Groups
Security groups act as virtual firewalls for individual EC2 instances and other VPC resources. They evaluate all traffic, allow only explicitly permitted connections, and are stateful, meaning return traffic is automatically allowed regardless of inbound rules.
Network Access Control Lists (ACLs)
Network ACLs operate at the subnet level and provide an optional stateless layer of filtering. They let you define explicit allow and deny rules for both inbound and outbound traffic, giving finer control over which IP ranges can reach resources inside a subnet.
VPC Flow Logs
VPC flow logs capture metadata about IP traffic flowing through network interfaces in your VPC. The logs help with troubleshooting access issues, monitoring for unusual patterns, and maintaining a record of allowed and rejected connections over time.
AWS Network Firewall and Additional Controls
AWS Network Firewall provides centralized, stateful inspection of VPC traffic with intrusion detection and prevention capabilities. You can also use AWS Web Application Firewall (WAF) with Application Load Balancers and Amazon CloudFront distributions fronting VPC-backed resources, and leverage AWS Shield for DDoS protection at the network edge.
Encryption and Access Management
While not exclusive to VPC, encryption controls apply directly to VPC resources. You can enforce HTTPS/TLS for data in transit, use VPC endpoints with private connectivity to AWS services, and integrate with AWS Identity and Access Management (IAM) and AWS Secrets Manager to control who can create, modify, or access VPC configurations.
Summary Table
| Feature | Scope | Stateful | Primary Use |
|---|---|---|---|
| Security Groups | Instance level | Yes | Allow/deny instance traffic |
| Network ACLs | Subnet level | No | Subnet-wide inbound and outbound filtering |
| VPC Flow Logs | VPC / subnet / ENI | N/A | Traffic monitoring and auditing |
| AWS Network Firewall | VPC level | Yes | Centralized inspection and threat prevention |
| VPC Endpoints | VPC to AWS services | N/A | Private connectivity without internet exposure |