Data Flow inside AWS
Internet : Internet GW <-> VPC <-> Route Table <-> NACL <-> Security Group <-> EC2 Instance
VPC
Route Table : Once Data Arrives at Subnet, RT attached to Subnet decides where to route data traffic , It cannot block/unblock, it can just route
Data Traffic may want to come to My Subnet
Data Traffic may want to go from Subnet to Other Subnet or May want to Go to Outside World
Route to Local or Route to IGW or Route to NAT Gateway.
0.0.0.0.0 : Traffic meant for "NOT VPC Subnet" -> Route to IGW or NAT
p.q.r.s/16 : "Subnet Traffic " -> Route Locally to Subnet
NACL : Once Data Traffic arrives at Subnet
It has to cross N/W Firewall - Subnet Firewall - known as NACL which may allow it or block it.
It checks Protocol Type, Port, Source/Destination (depending on Incoming/Outgoing Direction) and then allows or blocks, The rules are Numbered, If a Match is found, It can be DENY or ALLOW Rule and no further rules are processed.
Its stateless, You have to configure separate rule for incoming and outgoing and they both are independent of each other
Security Group :
Determines the traffic that can reach/leave your instance.
It is stateful
It has Incoming and Outgoing Rules
But Incoming is related to Outgoing
It has no DENY/ALLOW rule flag
All Rules are ALLOW by default
Rule says
-> Allow PROTOCOL on PORT from SOURCE - Incoming
-> Allow PROTOCOL on PORT from DESTINATION - Outgoing
SSH is TCP Protocol on 22
HTTP is TCP protocol on 80
PING in NCMP Protocol
If Incoming Rule allowed SSH on Port 80 and I did not mention Allow SSH on Port 22 for Outgoing, Even Then SSH will be allowed in Outgoing because its stateful, it remembers.
If Outgoing Rule is allowed, on PORT 80 and We did not Configure HTTP on Incoming Side
Even then SSH will be allowed on that Machine
