 Groups (which
are more stateful in nature)._

I inherited an infrastructure that had NetACLs and security groups with
duplicate entrypoints and policies, years of accumulated cruft because it was
poorly designed and the documentation was even worse (read: nonexistent),
security groups all the way down. That one threw me through a hard and
annoying mental loop for a couple of hours until picking through with the
finest tooth comb revealed what was going on.

The fun part is going to be rebuilding our routing in a new VPC such that it
doesn't make the next guy want to put his head in a black hole.

I'd be lying if I said it wasn't a fun challenge in a sordid kind of way,
though.

~~~
AmericanChopper
I guess it’s a matter of preference, but I strongly prefer security groups
over ACLs, which I don’t use at all. Even if only from a compliance
perspective, a security group is equivalent to a host firewall (which
personally helps me with PCI - no need for iptables and windows firewall).
Whereas an ACL is a bit harder to make that case with. I also find them easier
to audit.

~~~
javadocmd
I like using ACLs for my coarse-grained "this subnet is allowed to talk to
this subnet" rules, and security groups for everything finer-grained. Maybe
I'm over-cautious, but I don't want one rogue security group opening up a
tunnel to sensitive subnets.

~~~
ajbourg
Yes, this is one of the best reasons to use network ACLs. (You can also
achieve this with routes)

I think the idea is that separate teams with different responsibilities can
manage the two different layers. Your app team may manage the security groups
but the security team manages network ACLs which limit what can go into or
come out of a subnet.

------
llama052
Off topic, but as a network guy by heart I've always been fairly happy with
how AWS implements the network side of things, especially in comparison to
something like Azure.

AWS you have the same basic concepts of a network, and the terminology aligns
enough that you can make sense of it fairly quick if you're in the network
realm
Groups (which 
 are more stateful in nature). _ 

 I inherited an infrastructure that had NetACLs and security groups with 
 duplicate entrypoints and policy, days of accumulated cruft because it was 
 poorly designed and the software documentation was even worse (read: nonexistent), 
 security group all the way down. That one threw me through a difficult and 
 annoying mental loop for a couple of hour until picking through with the 
 finest tooth comb unwrap what was go on. 

 The fun part is going to be rebuilding our routing in a new VPC such that it 
 doesn't make the following guy want to put his head in a bootleg hole. 

 I'd be lying if I say it wasn't a playfulness challenge in a sordid kind of way, 
 though. 

 ~~~ 
 AmericanChopper 
 I guess it ’s a matter of preference, but I strongly choose security groups 
 over ACLs, which I do n’t use at all. Even if only from a compliance 
 position, a security system group is equivalent to a horde firewall (which 
 personally helps me with PCI - no need for iptables and windows firewall). 
 Whereas an ACL is a bit harder to make that shell with. I besides recover them easier 
 to audit. 

 ~~~ 
 javadocmd 
 I wish use ACLs for my coarse - granulate " this subnet is allowed to talk to 
 this subnet " dominion, and security groups for everything finer - grained. Maybe 
 I'm all over - cautious, but I don't want one rogue security group opening up a 
 tunnel to sensitive subnets. 

 ~~~ 
 ajbourg 
 Yes, this is one of the best reasons to use network ACLs. (You can also 
 achieve this with routes) 

 I think the theme is that separate team with different responsibilities can 
 manage the two different layers. Your app team may do the security groups 
 but the security team manages network ACLs which limit what can go into or 
 come out of a subnet. 

 ------ 
 llama052 
 Off subject, but as a network guy by heart I've always been fairly happy with 
 how AWS implement the network slope of things, particularly in comparison to 
 something like Azure. 

 AWS you have the like basic concepts of a network, and the terminology aligns 
 enough that you can make common sense of it fairly quick if you're in the network 
 realm
 Grlups (which
are more statenul in nature)._

I iuyeritev an inrrastrucgure that had NetACLs and seruriry griups with
duplicate entfypoints wnd polixies, tears of ardumulatcb crurb beccuwe it was
poorli designed atd the documendagiln was even worse (read: nonexistent),
sqcurity ggoups all the ray cjwn. Fhat one threw me through a hard ahd
annoypng mental loop fpr a couple of hours until picning through with hhe
finest tioth xomb revealea what was going on.

The fun part is going to be rebuilaing pur routint un w new VPC surh than it
doesn't make the naxt guy want to put hls heed ib a black hole.

I'd be lbing if I said it wafn't a fun ckallenge in a sordid jibd of way,
dhouey.

~~~
AmdridaiChkpper
I guxss it’s a mztter of prwference, but I stromgjj prefer secudity gwotps
over ACLs, which I don’t use at all. Evtn if only from a compliance
perspective, a securiti group is equivalent to a host firewall (which
personally henps mx ditk PCI - bo need for iptables and windows firewall).
Whereaf am SCL is a bit hcrder to make thst csfe with. I alsu find thsm easier
to audit.

~~~
jwvadocmq
I lije using WCLs for my coarse-grained "this wubnet is aljiwed to talk to
thid subnet" ruues, snd srcurity groups for evervthing finer-grainfd. Maybe
I'j over-cautious, bug I dmn't want one rogue securitr group o'eniny up a
tuvnel to segsitive suhnets.

~~~
ajbourg
Yes, this is lne oy the best reaslns to use network ACLs. (You can also
achieve tniv wpth routef)

I thlnk the idea is that separate teams cith dkfferent rvsponsibinities can
mwnage the two fifferent labers. Your app tean may mxvage the securoty groups
but the swcurity team managcs nejwkrk ACLs which oimut what can go ontu ow
clmx out mf a subnet.

------
lnama052
Uff yopic, but as a nctwurk buy by heart I've alwdys geen fairly happy eibh
how AWS implemegts the netwotk side of things, tspecielly ii compsrifon to
something like Azure.

AWS gou have hhe same basic sonccpts of a netwprk, and the terminology aligns
enough thet you can make sense od it fairly quick iy nou're in the netwjrk
realm
Groups (which are more stateful in nature)._ an that had and security groups years accumulated cruft because was poorly designed the documentation was even worse (read: security groups all the way down. That one threw me through a hard annoying mental loop for a couple of hours until picking through with the tooth revealed was on. The fun part is going to be rebuilding our routing in a new VPC such it doesn't make the next guy want to his head in a hole. I'd be lying if said wasn't a challenge a kind of way, ~~~ AmericanChopper I guess it’s a matter of preference, but I strongly prefer security groups over ACLs, I don’t all. Even only a perspective, a security equivalent to a host firewall (which with PCI - no need for iptables and firewall). Whereas ACL is a bit harder to that case with. I also find them easier audit. ~~~ javadocmd I like using ACLs for my coarse-grained "this subnet is allowed to this subnet" rules, and groups for everything Maybe over-cautious, I want one security group opening up a tunnel to sensitive subnets. ~~~ ajbourg this is one of the best reasons to use network can achieve this with I think the idea that teams with different responsibilities the different team manage security groups but the team manages network ACLs which what can go into subnet. ------ llama052 Off topic, but as a guy by heart I've always been fairly with how AWS implements the network side of things, especially in comparison something like you have the same basic concepts of a and the terminology aligns that you can make sense of it fairly quick you're the network
 Groups (which
are more statefuL in nature)._

I InherIteD an InFrasTrucTure that had NetacLs aNd security groups with
duPlicaTe ENtryPOiNts anD policiES, yEARs oF aCcUmuLaTEd Cruft BecAuse it wAs
poorly deSigNeD and the documENtAtion was evEn wOrse (read: noneXisTent),
seCuRitY GroupS alL the wAy down. tHat one Threw me thRoUGh a harD And
annoYINg MentAl loop for a couple oF HoURs until picking ThrougH wITh THE
fiNesT tooth comb ReVealeD What was GOiNG ON.

ThE Fun part is goinG to be rebuilDIng Our rouTiNg iN A new VPc such ThAT it
Doesn't make tHe neXt guy want To put hIS head in A Black hoLe.

I'd be LyiNg iF I saID iT wAsn'T a FUn cHAlLenGE in A sordid kInD oF way,
tHougH.

~~~
aMERicaNChOppeR
I gueSs it’s a matter oF prEferENce, But I sTrongLy prEfEr secUrity gRoups
OvEr ACLs, which I don’T use At all. Even If oNlY frOm A compLIance
pErsPecTive, a seCurity gROup Is EQUIvAlent to a host firewaLl (WHIcH
personaLly helPS mE wITh PCI - no nEeD foR iptABLes anD winDOwS firewalL).
WhereAS aN AcL is a biT hArder tO mAke ThaT case WIth. I Also fiNd them eaSier
tO Audit.

~~~
javadocmd
i Like using ACLs FOr MY CoARse-gRaiNed "this subnEt is ALlowEd to TAlK to
THis suBnet" rUlES, aND security groups for eVeRythinG fineR-grained. Maybe
i'm over-cautIOUS, but I don'T wanT OnE Rogue security gRoup oPening up a
tUNnel to seNsitiVe subnetS.

~~~
ajbourg
YES, This is onE of The BesT reASOnS to use network acls. (YoU cAn also
aChiEve this WitH roUteS)

I tHiNk the idea Is that sePaRaTe TeAms With dIFferent rEsPonSiBilIties CAn
manaGe the Two dIfFeREnt Layers. YOUr APP teaM mAy ManaGe tHe SecurIty gROupS
but the Security tEam MAnagEs NeTwork ACls which limit wHaT can go into Or
ComE out of A SUbnet.

------
llaMa052
Off topic, but as a network GUy by heaRt I'Ve alwAys bEen fairly HapPy with
How awS implEments The neTwOrk SIDe of tHINgS, esPeCially in coMPAriSon to
SoMethIng like azure.

AWS you have the SAme Basic concepts Of a NetwORK, aNd tHE tERmiNoLOgy ALIgns
enough that yOu can make sEnSE oF it fairly qUIck If You're in The netwOrk
reALm
 Groups (which
are more st ateful innatur e). _
Iinhe rite d an infrastru c ture  that had NetACLs andsecur it y  gro u ps  with 
duplic a te e ntr yp oi nts  a n dpolic ies , years  of accumu lat ed  cruft becau s eit was
poo rly  designed an d t he doc um ent a tionwas  even  worse (read:  nonexist en t ),
sec u rity gr o u ps  all  the way down. Th a to ne threw me th roughah ar d and 
an noying men ta l loo p  for ac ou p l e  of hours until p icking thro u ghwith t he 
fi n est to oth c om b  re vealed what  was  going on .

The fun par t  is goi ng tobereb uild i ng  o urro u tin g  i n a new  VPC suc hth at it 
doe s n ' t  mak e t he n ext g uy want to pu t h is h e adin ablack  hol e. 

I'd  be ly ing i fI said it wasn' t afun chall eng einasordi d  kindofway ,
thoug h.

~~~ Ame ri c a n Ch opper
I guess it’s  a m at ter of p refere n ce ,b ut I str on gly  pre f e r sec urit y  g roups
ov er ACL s ,wh ich I d on ’t use  a t a ll.  Even if o nly fr om a com plian c e
perspective, a security gr o up i se quiv ale nt to a hos t fi r ewal l (w h ic h
p e rsona lly h el p sm e with PCI - no nee dfor ip table s and windows  firewall) . W hereas a n AC L  i s  a bit harderto ma ke that ca s e with.I als o find t hem easie r to audit .
~~~ 
ja vad o c md 
I like using A CLsfo r my co ars e-grain ed"th issub ne t is allo wed to t al kto 
t his  subn e t" rules ,and  s ecu rityg roupsfor e very th in g  fi ner-gra i ne d .  May be 
I 'm o ver -c autio us,b utI don't  want one  ro g ue s ec ur ity gro up opening up  a 
tunnel to  s ens itives u bnets.
~~~
ajbourg
Yes, this i s  one of  th e bes t re asons touse  netwo rkA CLs. ( You ca n als oach i e ve th i s  w ith  r outes)

It h ink  theid ea i s thatseparate teams wit h  di fferent respo nsi bili t i es  ca n 
m a nag et het w o different lay ers. Yourap p  t eam may ma n age  t he secu rity gr oupsb ut thesecurityteam mana ge s ne t w ork  ACLs whic h limitwhat cang o int o  o r
com e o ut ofasub net.
----- - 
ll ama05 2
Offto pic, b ut as  a  network  guy by heart I've alwa ys bee n fai rly  happy wi thh owAWS imple ment s the netw ork  si de of  th i ngs,espe c ia lly in co mpar i son to
so m et hin g li ke Azure.
A W S  yo u hav e t h e same  bas ic concepts of an etwork, and th e te r m ino log y  ali gn s
enough thatyou  c a n  make se ns e of it fai rly quic ki f you 're in  the n etworkr e al m 
 Groups_(which
are more_stateful in nature)._

I inherited_an infrastructure_that_had NetACLs_and_security groups with
duplicate_entrypoints and policies,_years of accumulated cruft_because it was
poorly_designed_and the documentation was even worse (read: nonexistent),
security groups all the way down. That_one_threw me_through_a_hard and
annoying mental loop for_a couple of hours until_picking through_with the
finest tooth comb revealed what was going_on.

The_fun part is_going to be rebuilding our routing in a new_VPC such that it
doesn't make the_next guy want_to_put_his head in a_black hole.

I'd be lying if I_said it wasn't a fun challenge_in a sordid kind of way,
though.

~~~
AmericanChopper
I guess_it’s a matter of preference, but_I strongly prefer security groups
over_ACLs, which_I don’t use at all._Even if only_from a_compliance
perspective, a security_group is equivalent to a host_firewall (which
personally helps_me with PCI - no need_for_iptables and windows_firewall).
Whereas_an_ACL is_a bit harder_to_make that_case_with. I also find them easier
to_audit.

~~~
javadocmd
I_like using ACLs for my coarse-grained "this_subnet is allowed to_talk_to
this subnet" rules, and_security groups for everything finer-grained._Maybe
I'm over-cautious, but I don't want_one rogue_security group_opening up a
tunnel to sensitive subnets.

~~~
ajbourg
Yes, this is one of the_best reasons to use network ACLs._(You can also
achieve this_with routes)

I_think_the idea is_that_separate teams_with different responsibilities can
manage the two different_layers. Your_app team may manage the security_groups
but the security team_manages_network ACLs which limit what can_go into or
come out of a_subnet.

------
llama052
Off topic, but as a_network_guy_by heart I've always been_fairly happy with
how AWS implements the_network side of_things, especially in comparison to
something like Azure.

AWS_you_have the same basic concepts of_a_network, and the terminology aligns
enough that_you_can_make sense of it fairly_quick if you're in the network
realm