---
title: "Network ACLs (NACLs) versus Security Groups (SGs) [Cheat Sheet] - Cybr"
description: "Learning about AWS security groups and NACLs? Here's a downloadable cheat sheet with explanations and examples!"
url: https://cybr.com/cloud-security/network-acls-nacls-versus-security-groups-sgs-cheat-sheet/
---

# Network ACLs (NACLs) versus Security Groups (SGs) \[Cheat Sheet\]

To control the flow of data in and out of your VPCs and Subnets in AWS, you can use Network Access Control Lists (NACLs), Security Groups…

Christophe

Published September 20, 2023 · Updated June 18, 2024

To control the flow of data in and out of your VPCs and Subnets in AWS, you can use Network Access Control Lists (NACLs), Security Groups (SGs), or both.

But when should you use which? Let’s take a quick look.

## Keeping threats out

As a general rule of thumb, you should always use Security Groups. They’re applied directly to hosts, like web servers or database instances, which means they’re one of the last layers of defense.

With that said, you typically want to block threats as far away from your important resources/data as you can. So ideally, you’d want to block threats before they even get near your hosts. That’s where NACLs step in because they’re applied at the subnet level and they can look at every request going in or out of a subnet.

That means NACLs can block broad ranges of sources/destinations that you know should never be allowed in or out of a subnet, while SGs can block with much more specificity depending on the resource they’re designed to protect.

## Containing threats

Oftentimes, people talk about keeping threats outside of the VPC using these security controls, but what if a threat makes it through? You can also use these controls for containment and isolation:

- Amazon VPCs provide network isolation for a group of subnets
- NACLs provide subnet-based containment
- Security groups provide host-based containment

This cheat sheet explains that and a lot more, so save it as a reference guide!

[View Security Groups vs. NACLs cheat sheet](https://cybr.com/cheat-sheets/nacl-vs-sgs/)

### There’s a lot more to security groups and NACLs. If you’d like to learn more, check out our [Introduction to AWS Security course](https://cybr.com/courses/introduction-to-aws-security/)!

### Want more cheat sheets like this? [Check them out here](https://cybr.com/tag/cheat-sheets/).

## Filed under

- [Cloud Security](https://cybr.com/cloud-security/)
- [Network Security](https://cybr.com/network-security-archives/)
- [AWS](https://cybr.com/tag/aws/)
- [AWS Security](https://cybr.com/tag/aws-security/)
- [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/)
- [Cheat Sheets](https://cybr.com/tag/cheat-sheets/)
- [Cloud Security](https://cybr.com/tag/cloud-security/)

## Comments

Loading comments…

Recommended resources

[![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/)

## Build practical AWS security skills

Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice.

[Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)