Infrastructure Security
Layered network controls
Security groups are stateful, allow-only, and attached to ENIs/instances, so return traffic is automatic and there is no deny rule. NACLs are stateless, evaluated by rule number (lowest first, first match wins), and attached to subnets - you must allow both the request port and the ephemeral return range 1024–65535. A question that asks for a deny at the instance level is a trick: use a NACL, AWS Network Firewall, or put the workload behind WAF.
At layer 7, AWS WAF attaches to CloudFront, ALB, API Gateway and AppSync - not to EC2 directly. Shield Standard is automatic and free; Shield Advanced adds DDoS cost protection and the response team. Network Firewall gives stateful, VPC-level filtering with Suricata-compatible rules, useful for egress control. PrivateLink interface endpoints keep traffic off the internet; gateway endpoints serve only S3 and DynamoDB.
Hardening compute
Prefer SSM Session Manager over a bastion host - no inbound port 22, no key pairs, full session audit in CloudTrail, Logs and S3. Patch with SSM Patch Manager, scan with Inspector, enforce IMDSv2 (raise the hop limit to 2 only where containers need it) to blunt SSRF credential theft, and scan ECR images on push. For EKS, enable control-plane audit logging and use security groups for pods; put Lambda in a VPC only when it must reach private resources.
Rule of thumb
Stateful means "allow once, remember the return"; stateless means "write both directions and number the rules carefully." When a scenario says "block this specific IP," a NACL deny rule is the cheapest correct answer.