SecurityGroups NACLs
Security groups (stateful, per-instance) and NACLs (stateless, per-subnet) are the two firewall layers controlling what traffic can actually leave/enter — a correct route to a NAT Gateway still won't work if egress is blocked here.
Why we need this / what value this brings
A correctly-routed request that gets silently dropped by a firewall rule is one of the most confusing failure modes to debug, because 'the route exists' looks like it should work.
When to use this
Every resource needs at least an explicit outbound-allow rule (security groups often default-allow all outbound, but don't assume it); NACLs matter specifically when something more restrictive than the default has been configured.
How to use or implement this
Check security group egress rules first (stateful — a request out automatically allows its response back); only dig into NACLs if security groups look correct and traffic is still blocked, since NACLs are stateless and easy to misconfigure for return traffic.
Research questions
- For the OpenRouter scenario: does the EC2 instance's security group actually allow outbound 443, and does the private subnet's NACL allow the ephemeral-port return traffic (NACLs are stateless, unlike security groups)?
Empty folder — drop notes, links, and findings here as you research.