How to configure a NACL in a private subnet connected to internet via nat gateway?

Question

Do we need to open NACL for private subnet from both inbound and outbound, to the internet when my subnet is routed to NATgateway to access internet. If yes how secured it is. The only restrictions for private subnet would be on the route table as NACL +security grp will be open.

Answer 1

In general, you should never need to change the configuration of Network ACLs in a VPC.

Traditional networking uses rules in Routers that control traffic between subnets. However, AWS and other cloud services have Security Groups that allow controls to be placed on individual resources , which offers finer-grained security.

The only situations you should need to modify Network ACLs is when intentionally locking down security, such as creating a DMZ .

Configuring Network ACLs is also quite complex because they are stateless , so permissions need to be granted in both directions. Security Groups, in contrast, are stateful so (for example) communication can happen with only Inbound rules and no Outbound rules.

Bottom line: It is best to learn your Network ACLs with their default "Allow All" configuration.