Firewall

How Security Groups (stateful, per-instance) and NACLs (stateless, per-subnet) form different layers of defense in a VPC, plus the common pitfalls each surface.