A misconfigured AWS VPC is the starting point of most cloud security incidents. Here is how to harden every layer — subnets, Security Groups, NACLs, and IAM — for production.
Security Groups are stateful firewalls attached to individual resources — they only support allow rules, not deny. NACLs are stateless firewalls at the subnet level and support both allow and deny rules. To block a specific IP address or CIDR range, you must use a NACL. Security Groups cannot explicitly deny traffic.
Set the subnet's auto-assign public IPv4 setting to disabled at the subnet level in the VPC console. Additionally, use an SCP at the AWS Organizations level to deny ec2:RunInstances when the network interface is configured with a public IP — this enforces the rule even if someone manually overrides subnet defaults.
Discussion0