What are the differences between security groups in a VPC and network ACLs in a VPC?
VPC 中的安全群組和 VPC 中的網路 ACL 有什麼差異？
Security groups in a VPC specify which traffic is allowed to or from an Amazon EC2 instance. Network ACLs operate at the subnet level and evaluate traffic entering and exiting a subnet. Network ACLs can be used to set both Allow and Deny rules. Network ACLs do not filter traffic between instances in the same subnet. In addition, network ACLs perform stateless filtering while security groups perform stateful filtering.
VPC 中的安全群組指定獲允許進出 Amazon EC2 執行個體的流量。而網路 ACL 會在子網路層級上運作，並評估進出子網路的流量。網路 ACL 可用來設定允許和拒絕規則。網路 ACL 不會篩選相同子網路中執行個體之間的流量。此外，網路 ACL 執行無狀態篩選，而安全群組則執行狀態篩選。