Which AWS feature acts as a firewall at the subnet level inside a VPC?

A Network Access Control List (NACL) acts as a stateless firewall at the subnet level. It evaluates inbound and outbound traffic for an entire subnet based on rules you define, allowing or denying traffic. Each rule has an allow or deny action and an associated rule number, processed in order. Security groups, while also firewalls, operate at the instance level and are stateful. Elastic Network Interfaces are virtual network cards for EC2 instances. AWS WAF (Web Application Firewall) protects web applications from common web exploits, operating at the application layer, not the subnet level.