Security groups control traffic to a SPECIFIC resource in a

subnet

NACL provides stateless firewall at subnet level

Stop traffic from even entering the subnet

Each subnet must be associated with a NACL

Default NACL allows all inbound and outbound traffic.

Custom created NACL denies all inbound and outbound traffic by default.

Rules have a priority number.

Lower number => Higher priority