Network Security
Network security here is about controlling path, identity and inspection in environments where the perimeter is a set of policy attachments rather than a firewall at the building edge. Scenarios typically ask you to choose between security groups and network ACLs, decide where TLS inspection belongs, or justify a private endpoint over an internet-facing endpoint with an IP allowlist.
Segmentation controls
Security groups are stateful and allow-only, attach to network interfaces, and can reference other security groups or managed prefix lists. Statefulness means return traffic is automatic. Network ACLs are stateless, subnet-level and evaluated in order; you must permit both directions, including ephemeral ports 1024-65535 for client flows. Prefer identity-based policy - group-to-group references, service accounts, workload identity - over IP allowlists that break the moment autoscaling changes an address.
Inspection placement
Centralized inspection through a firewall VPC requires symmetric routing. Attach the firewall appliance with transit gateway appliance mode, or use a gateway load balancer endpoint, and confirm both directions of a flow traverse the same stateful device. Asymmetric paths are the classic cause of dropped sessions that appear intermittent.
Encryption and private access
Site-to-site uses IPsec; remote access uses TLS or client VPN; east-west uses mTLS or a service mesh. Private connectivity options - dedicated interconnect, private endpoints, PrivateLink-style services - keep traffic off the internet entirely. Private endpoints need private DNS zones, otherwise name resolution returns a public address and traffic hairpins back out.
Worked example
An application must read objects privately and call a partner API over the internet, with a static partner allowlist. Private object access: create a private endpoint plus an endpoint policy restricting which buckets are reachable, and attach a private hosted zone so the service name resolves internally. Partner access: route through a NAT gateway with elastic IPs, give the partner those addresses, and keep the private side deny-by-default. Reasoning: keep the private path off the internet, give the internet path a stable identity, and log both flows.
Traps
Treating NACLs as stateful; forgetting ephemeral return ports; assuming a security group reference works across accounts or regions when it does not; TLS inspection breaking certificate pinning or mTLS; leaving a default allow-all rule in a firewall policy; logging flow data but never alerting on denies.