Definition
A Network Access Control List, or Network ACL, is a stateless security layer that acts as a firewall for your virtual network. It controls inbound and outbound traffic at the subnet level, allowing or denying packets based on defined rules. Network ACLs operate by evaluating rules in order, from lowest to highest number, and applying the first matching rule. This capability is crucial for enforcing granular security policies and segmenting network traffic to prevent unauthorized access. For instance, a Network ACL can be configured to deny all traffic to a specific subnet except for traffic originating from a trusted IP address range. Unlike security groups, which are stateful and associated with individual instances, Network ACLs are stateless and apply to the entire subnet, meaning you must define rules for both inbound and outbound traffic. You will encounter Network ACLs in cybersecurity certifications like CompTIA Security+ and CySA+, as well as AWS architecture exams.