Security groups and network ACLs

Start as usual and load the network:

cd C:\aws-lab
aws login --profile saat-admin
$env:AWS_PROFILE = 'saat-admin'
$v = Get-Content C:\aws-lab\saat-vpc.json | ConvertFrom-Json

1Create the three security groups

Paste this whole block:

function New-Sg($Name, $Desc) {
  aws ec2 create-security-group --group-name $Name --description $Desc --vpc-id $v.VpcId --tag-specifications "ResourceType=security-group,Tags=[{Key=Name,Value=$Name},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=10}]" --query GroupId --output text
}
$web = New-Sg 'saat-web-sg' 'Web tier: HTTP and HTTPS from the internet'
$app = New-Sg 'saat-app-sg' 'App tier: 8080 from the web tier'
$db  = New-Sg 'saat-db-sg'  'Database tier: SQL Server from the app tier'
$web, $app, $db

You should see three IDs, something like this:

sg-0a1b2c3d4e5f60718
sg-0b2c3d4e5f6a70819
sg-0c3d4e5f6a7b8091a

2Add the inbound rules

Paste this whole block:

aws ec2 authorize-security-group-ingress --group-id $web --protocol tcp --port 443 --cidr 0.0.0.0/0 | Out-Null
aws ec2 authorize-security-group-ingress --group-id $web --protocol tcp --port 80 --cidr 0.0.0.0/0 | Out-Null
aws ec2 authorize-security-group-ingress --group-id $app --protocol tcp --port 8080 --source-group $web | Out-Null
aws ec2 authorize-security-group-ingress --group-id $db --protocol tcp --port 1433 --source-group $app | Out-Null

3Read the rules back

Run this (note the single quotes: the backticks inside are part of the query):

aws ec2 describe-security-group-rules --filters "Name=group-id,Values=$db" --query 'SecurityGroupRules[?IsEgress==`false`].[IpProtocol,FromPort,ToPort,ReferencedGroupInfo.GroupId]' --output text
aws ec2 describe-security-group-rules --filters "Name=group-id,Values=$db" --query 'SecurityGroupRules[?IsEgress==`true`].[IpProtocol,CidrIpv4]' --output text

You should see something like this:

tcp     1433    1433    sg-0b2c3d4e5f6a70819
-1      0.0.0.0/0

The first line is the only way in: SQL Server port 1433 from the app group. The second line is the default outbound rule (all protocols, anywhere).

4Save the group IDs

Run this:

foreach ($p in @{WebSg=$web; AppSg=$app; DbSg=$db}.GetEnumerator()) {
  $v | Add-Member -NotePropertyName $p.Key -NotePropertyValue $p.Value -Force
}
$v | ConvertTo-Json | Set-Content C:\aws-lab\saat-vpc.json

5See the default network ACL

Run this:

aws ec2 describe-network-acls --filters "Name=vpc-id,Values=$($v.VpcId)" Name=default,Values=true --query "NetworkAcls[0].Entries[].[Egress,RuleNumber,RuleAction,CidrBlock]" --output text

You should see something like this:

True    100     allow   0.0.0.0/0
True    32767   deny    0.0.0.0/0
False   100     allow   0.0.0.0/0
False   32767   deny    0.0.0.0/0

Rule 100 allows everything in both directions; rule 32767 (shown as * in the console) denies anything that reached it. Because 100 comes first, everything is allowed.

6Test a stateless ACL

Create a demo network ACL (not attached to any subnet) that allows HTTPS in, and a small rule checker:

$demo = aws ec2 create-network-acl --vpc-id $v.VpcId --tag-specifications 'ResourceType=network-acl,Tags=[{Key=Name,Value=saat-nacl-demo},{Key=course,Value=saatvedha-aws},{Key=lesson,Value=10}]' --query NetworkAcl.NetworkAclId --output text
aws ec2 create-network-acl-entry --network-acl-id $demo --ingress --rule-number 100 --protocol tcp --port-range From=443,To=443 --cidr-block 0.0.0.0/0 --rule-action allow

function Test-NaclRule($NaclId, [switch]$Outbound, [int]$Port) {
  $e = aws ec2 describe-network-acls --network-acl-ids $NaclId --query "NetworkAcls[0].Entries" --output json | ConvertFrom-Json
  $e | Where-Object { $_.Egress -eq [bool]$Outbound } | Sort-Object RuleNumber | Where-Object {
      $_.Protocol -eq '-1' -or ($_.Protocol -eq '6' -and $Port -ge $_.PortRange.From -and $Port -le $_.PortRange.To)
  } | Select-Object -First 1 RuleNumber, RuleAction
}
Test-NaclRule $demo -Port 443
Test-NaclRule $demo -Outbound -Port 50123

You should see this:

RuleNumber RuleAction
---------- ----------
       100 allow

RuleNumber RuleAction
---------- ----------
     32767 deny

HTTPS gets in, but the reply to the client’s port 50123 is denied on the way out. A web server behind this ACL would accept connections and never answer. Add the outbound rule for ephemeral ports and test again:

aws ec2 create-network-acl-entry --network-acl-id $demo --egress --rule-number 100 --protocol tcp --port-range From=1024,To=65535 --cidr-block 0.0.0.0/0 --rule-action allow
Test-NaclRule $demo -Outbound -Port 50123
aws ec2 delete-network-acl --network-acl-id $demo

You should see this:

RuleNumber RuleAction
---------- ----------
       100 allow

✅ Checkpoint: saat-web-sg, saat-app-sg and saat-db-sg exist with the chain of rules and are saved in saat-vpc.json, and you saw a stateless ACL block replies until an outbound rule was added. Keep the three groups.