KR_AWS_Network - somaz94/DevOps-Engineer GitHub Wiki

AWS Network ACL vs Security Group

6. AWS Network ACL vs Security Group

Security Group(Stateful) AWS Network ACL(Stateless)
μΈμŠ€ν„΄μŠ€ κΈ°μ€€ 적용(1μ°¨ λ³΄μ•ˆ 계측) μ„œλΈŒλ„· κΈ°μ€€ 적용(2μ°¨ λ³΄μ•ˆ 계측)
룰에 λŒ€ν•œ ν—ˆμš© κ·œμΉ™λ§Œ 지원 룰에 λŒ€ν•œ ν—ˆμš© 및 κ±°λΆ€ κ·œμΉ™ 지원
μ•„μ›ƒλ°”μš΄λ“œ μš”μ²­μ— λŒ€ν•œ 응닡 μžλ™ ν—ˆμš© μ•„μ›ƒλ°”μš΄λ“œ μš”μ²­μ— λŒ€ν•œ 응닡 κ·œμΉ™ μ •μ˜ ν•„μš”
λ“±λ‘λœ λͺ¨λ“  κ·œμΉ™μ„ ν‰κ°€ν•˜μ—¬ νŠΈλž˜ν”½ ν—ˆμš© λ“±λ‘λœ κ·œμΉ™μ˜ 번호순으둜 νŠΈλž˜ν”½ ν—ˆμš© 및 κ±°λΆ€
νŠΉμ • 그룹을 μ§€μ •μ‹œμ—λ§Œ Instance에 적용됨 μ„€μ •λœ μ„œλΈŒλ„· ν•˜λ‹¨μ˜ λͺ¨λ“  Instance에 μžλ™ 적용됨
flowchart TB
    subgraph Region
        subgraph VPC ["VPC (10.0.0.0/16)"]

            IGW((("Internet Gateway")))

            Router[("Router")]

            IGW <--> Router

            subgraph Subnet1 ["Subnet"]
                SG1["Security Group"]
                EC2_1A(["EC2"])
                EC2_1B(["EC2"])
                SG1 <--> EC2_1A
                SG1 <--> EC2_1B
            end

            subgraph Subnet2 ["Subnet"]
                SG2["Security Group"]
                EC2_2A(["EC2"])
                EC2_2B(["EC2"])
                SG2 <--> EC2_2A
                SG2 <--> EC2_2B
            end

            RouteTable1["Route Table"]
            RouteTable2["Route Table"]

            ACL1[("Network ACL")]
            ACL2[("Network ACL")]

            Router <--> RouteTable1 <--> ACL1 <--> Subnet1
            Router <--> RouteTable2 <--> ACL2 <--> Subnet2
        end
    end
Loading

μ œν•œ 사항

  • Network ACL

    • 1개의 VPC에 Network ACL은 μ΅œλŒ€ 200개 κΉŒμ§€ 생성 κ°€λŠ₯
    • 1개의 Network ACL에 등둝 κ°€λŠ₯ν•œ κ·œμΉ™μ€ κΈ°λ³Έ κ±°λΆ€ κ·œμΉ™μ„ ν¬ν•¨ν•˜μ—¬ μΈλ°”μš΄λ“œ μ΅œλŒ€ 20개, μ•„μ›ƒλ°”μš΄λ“œ μ΅œλŒ€ 20개 등둝 κ°€λŠ₯. ν•œλ„λŠ” μ΅œλŒ€ 40κ°œκΉŒμ§€ 늘릴 수 μžˆμœΌλ‚˜ μΆ”κ°€ κ·œμΉ™μ„ μ²˜λ¦¬ν•˜κΈ° μœ„ν•΄ μ›Œν¬λ‘œλ“œκ°€ μ¦κ°€λ˜μ–΄ λ„€νŠΈμ›Œν¬ μ„±λŠ₯에 영ν–₯을 쀄 수 있음
  • Security Group

    • 1개의 VPC에 Security Group은 μ΅œλŒ€ 2500개 κΉŒμ§€ 생성 κ°€λŠ₯
    • Security Group별 μΈλ°”μš΄λ“œ κ·œμΉ™μ€ μ΅œλŒ€ 60개, μ•„μ›ƒλ°”μš΄λ“œ κ·œμΉ™μ€ μ΅œλŒ€ 60개 등둝 κ°€λŠ₯
    • 1개의 Instance Network Interface에 μ„€μ •ν•  수 μžˆλŠ” SGλŠ” μ΅œλŒ€ 5개 μ„€μ • κ°€λŠ₯

β†’ λͺ©λ‘μœΌλ‘œ λŒμ•„κ°€κΈ°

⚠️ **GitHub.com Fallback** ⚠️