Difference between SecurityGroup and NACL

Question

While going through the VPC, came across that both SG and NACL can be used to allow/restrict traffic. When do we use what?

Answer 1

As mentioned both SG and NACL allow/restrict inbound and outbound traffic. When the traffic comes into the VPC, then it must go through the rules of NACL and go through the rules of SG, finally reach the AWS resource like EC2, RDS etc.

The SG is called the 1 st line of defense as it close to the AWS resource and the NACL is called the 2 nd line of difference. For more details about the differences between the SG and NACL, check out the official documentation from AWS here.