The company needs stateless network filtering for resources in a VPC. Which AWS tool or feature provides stateless network filtering?

A Network Access Control List (NACL) provides stateless network filtering for subnets within a VPC. "Stateless" means that NACLs do not keep track of connection state; inbound and outbound rules are evaluated independently. For example, if you allow inbound traffic on a specific port, you must explicitly allow the corresponding outbound return traffic. Security groups, in contrast, are stateful firewalls that operate at the instance level. They automatically allow return traffic for any allowed inbound or outbound connection. AWS PrivateLink is a service that provides private connectivity between VPCs and services, not a filtering tool. AWS WAF (Web Application Firewall) protects web applications from common web exploits at the application layer, not at the network layer for general VPC resources.