VPC与NACL配置疑问：VPC与子网NACL不同是否影响QA实例访问？

Great question! Let’s break this down clearly to get to the bottom of it:

First, a critical AWS NACL rule to remember: When a subnet is linked to a custom NACL, that subnet-level NACL fully replaces the VPC’s default NACL for all resources inside the subnet. Your QA instance lives in VPC-appsubnet, so only the subnet’s NACL rules govern its traffic—the VPC’s NACL settings don’t have any impact on this instance at all.

So the mere fact that your VPC and subnet NACLs have different configurations won’t directly cause access problems. The real issue to focus on is: does your subnet’s NACL include the correct rules to allow the traffic you need for your QA instance?

Here are key checks to ensure smooth access:

• NACLs are stateless: Unlike security groups, you have to explicitly allow both inbound and outbound traffic. For example, if you want to SSH into your QA instance, you need an inbound rule permitting port 22 from your IP, plus an outbound rule allowing ephemeral ports (typically 1024-65535) to let return traffic flow back.
• Rule priority is king: NACL rules are evaluated in order of their assigned number (lower numbers run first). If a deny rule comes before an allow rule for the same traffic type, the deny will take precedence.
• Don’t forget the default deny: Every NACL ends with a "deny all" rule that applies to any traffic not explicitly allowed by earlier rules. Make sure your necessary traffic is covered by explicit allow rules before this final catch-all.

To put it in context: If your VPC’s NACL allows all inbound/outbound traffic, but your subnet’s NACL blocks inbound HTTP (port 80), you won’t be able to reach your QA instance over HTTP—even though the VPC NACL permits it. On the flip side, if your subnet’s NACL has all the right allow rules, the VPC’s NACL settings don’t matter for this instance.

内容的提问来源于stack exchange，提问作者Adi