A network ACL is a list of allow and deny rules for a subnet, by direction, protocol, port and address range. Every subnet uses exactly one ACL, and the same rules apply to every instance in the subnet regardless of its security groups. ACLs are enforced at each instance’s network interface, so they apply to every packet that crosses the subnet’s boundary, in any VPC, whether or not it has an Internet Gateway.
Where ACLs are enforced
An ACL applies to traffic between an instance in its subnet and an address outside that subnet:
| Traffic | ACL rules that apply |
|---|---|
| Between two instances in the same subnet | None |
| From subnet A to subnet B of the same VPC | Egress rules of A’s ACL, then ingress rules of B’s ACL |
| From a subnet to the internet | Egress rules of the subnet’s ACL |
| From the internet to a subnet | Ingress rules of the subnet’s ACL |
ACLs are stateless, so this applies to reply traffic too. A reply from subnet B to subnet A needs an egress rule in B’s ACL and an ingress rule in A’s ACL. A reply from a subnet to an internet client needs an egress rule in the subnet’s ACL, and the replies an instance receives to its own outbound connections need an ingress rule.
Traffic between an instance and the VPC’s DNS resolver or the instance metadata service isn’t filtered by ACLs.
How rules are evaluated
Each rule has a priority, a direction, a protocol, a port, an address range and a policy:
| Field | Values |
|---|---|
priority | A number from 0 to 65535. Lower numbers are evaluated first. |
direction | ingress (traffic entering the subnet) or egress (traffic leaving it). |
protocol | any, tcp, udp or icmp. icmp means ICMP when source is an IPv4 range and ICMPv6 when it is an IPv6 range, all message types. |
port | A single port, a range such as 1024-65535, or any. Applies only with tcp or udp. ICMP has no ports: an icmp rule must use any, and any other port is refused. |
source | For ingress, the address range the traffic comes from. For egress, the range it goes to. |
policy | accept or drop. |
The first rule that matches decides. Traffic that matches no rule is denied. A rule matches one address family, so allowing both IPv4 and IPv6 takes one rule for 0.0.0.0/0 and one for ::/0.
The default ACL
Every VPC gets a default ACL, and every new subnet uses it. It allows all traffic in both directions and both address families, with four rules at priorities 500 to 530. Edit it, or create more ACLs when subnets need different rules.
A VPC’s default ACL can’t be deleted on its own; it goes with the VPC.
Create and assign a network ACL
create-acl adds an ACL with no rules to a VPC. Add rules with update-acl-rules, which replaces the whole list. For example, to allow HTTPS in from anywhere and everything out:
origin network update-acl-rules --acl-urn <acl-urn> \
--rule 'priority=100,direction=ingress,protocol=tcp,port=443,source=0.0.0.0/0,policy=accept' \
--rule 'priority=200,direction=egress,protocol=any,port=any,source=0.0.0.0/0,policy=accept'Then point a subnet at it. The ACL must belong to the subnet’s VPC, and the change applies to the subnet’s traffic without recreating anything.
origin network update-subnet-acl --subnet-urn <subnet-urn> --acl-urn <acl-urn>To leave an ACL with no rules, say so with --no-rules; update-acl-rules with neither --rule nor --no-rules is refused. See Rule sets are replaced as a whole.
An ACL other than the default can’t be deleted while a subnet still uses it.