I have a VPC with public and privet subnets. A load balancer serves instances with web servers in private subnets. I have security groups in place to allow only HTTP traffic for the balancer and only local HTTP traffic for instances.

Should I also set inbound/outbound rules for NACL on the VPC and each subnet? Now the default seems to be to allow all the traffic.

Should I consider limiting traffic with NACL according to my needs (HTTP, ssh, etc)? or it's overkill or not very useful or overly complex?

1 Answer 1


This is indeed opinion-based but if you've got your Security Groups right adding NACLs between Public and Private subnets is an overkill.

Typically I use NACL mainly in 2 scenarios:

  1. To separate Dev / Test / Qual / Prod subnets where we expect no traffic at all between them.
  2. Or when it's a PCI / HIPAA / etc deployment and the auditor absolutely positively insists on having NACL between the subnets and can't be convinced otherwise.

In all other cases well designed Security Groups are enough. Where with well designed I mean mostly:

  • SG's refering to other SG ID's and not to IP ranges (e.g. Web server SG permits tcp/443 from ALB SG ID, not from the public subnet IP range).
  • Define Outbound rules to Deny unless needed otherwise.
  • And of course only permit the required ports.

That way you can very well contain and restrict your networking traffic without having to use NACLs.

Hope that helps :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.