Amazon ANS-C01: Network Security and Compliance — Study Guide

By Laurynas Brazys · 3 August 2026 · #amazon #ans-c01 #certification #exam-prep #study-guide

Part of the AWS Advanced Networking Specialty ANS-C01 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.

Core concept

Network security in AWS is layered: perimeter controls, VPC-level controls, host- and application-level controls, and monitoring/inspection. At the VPC boundary you use security groups (stateful, host-centric virtual firewalls applied to ENIs) and network ACLs (stateless, subnet-level filtering evaluated by rule number) to enforce coarse access controls. Security groups track connection state so an established reply flow is automatically allowed, making them ideal for allowing client-initiated connections to pods or instances. NACLs require explicit allow entries in both directions or complementary rules for return traffic; they are evaluated in ascending rule order and therefore appropriate for broad subnet-level hardening such as eliminating entire CIDR ranges or applying ephemeral escape-hatches for emergency block lists.

Inspection and centralized policy enforcement are provided by managed and self-managed services. AWS Network Firewall can implement stateful Suricata-like protections, domain-list filtering, and intrusion-prevention style signatures at the VPC perimeter with explicit firewall policies and rule groups. Web Application Firewall (AWS WAF) is application-focused for HTTP(S) layer protection and integrates with Application Load Balancer, Amazon CloudFront, and API Gateway to enforce OWASP protections, rate-based rules, and custom header checks. DDoS protections are provided by AWS Shield (Standard is automatic and free; Shield Advanced provides traffic engineering, cost protection, and integration with WAF for application-layer mitigation). Detection services such as Amazon GuardDuty analyze VPC Flow Logs, DNS logs, and CloudTrail to surface reconnaissance, port scans, and compromised instance behavior.

Visibility and packet capture complete the model. VPC Flow Logs record per-ENI flow metadata and can be delivered to CloudWatch Logs, Amazon S3, or Kinesis Data Firehose for analysis with Athena. For full-packet capture or deeper inspection, Traffic Mirroring allows mirroring of ENI traffic to an IDS/packet capture appliance (an EC2 sensor with a mirrored ENI or a Network Load Balancer target) where tools like Suricata or Zeek run. Together, these controls enable a defense-in-depth posture where prevention, detection, and forensics are all present.

Key services and configuration

Several AWS services are central to network security and each has specific configuration patterns and APIs to know:

• Security Groups
• Network ACLs (NACLs)
• AWS Network Firewall
• AWS WAF
• AWS Shield (Standard and Advanced)
• Amazon GuardDuty
• VPC Flow Logs
• Traffic Mirroring

Security groups are configured per ENI via the EC2 API or Console; to add an ingress rule use “aws ec2 authorize-security-group-ingress –group-id sg-123 –protocol tcp –port 443 –cidr 0.0.0.0/0”. Remember to use least privilege CIDRs and to attach separate SGs for load balancers and backend pods to avoid overbroad rules. Create NACLs via “aws ec2 create-network-acl” and add numbered entries with “aws ec2 create-network-acl-entry” specifying rule-number, rule-action, protocol, port-range, and egress flag.

AWS Network Firewall uses rule groups and firewall policies bound to a firewall resource created in a VPC subnet. Use “aws network-firewall create-rule-group” to define stateless or stateful rules, “aws network-firewall create-firewall-policy” to compose them, and “aws network-firewall create-firewall” to deploy. Choose stateful rule groups for protocol-aware inspection and Suricata-compatible signature rules; use stateless rules for very high throughput, first-pass filtering.

AWS WAF attaches a Web ACL to an ALB and can enforce IP set matches, string match on headers, or rate-based rules. Use “aws wafv2 create-web-acl” and specify rules that check headers (for example, block requests that do not contain a custom header you inject at your trusted front door). AWS Shield Advanced is enabled per account and provides DDoS response team access and additional protections for resources registered with Shield Advanced.

Enable GuardDuty via “aws guardduty create-detector” and integrate findings with CloudWatch Events or EventBridge for automation. For telemetry, create VPC Flow Logs via “aws ec2 create-flow-logs –resource-type VPC –resource-id vpc-123 –traffic-type ALL –log-destination-type cloud-watch-logs –log-group-name /aws/vpc/flowlogs”. For packet capture, use “aws ec2 create-traffic-mirror-target”, “aws ec2 create-traffic-mirror-filter”, and “aws ec2 create-traffic-mirror-session” to direct mirrored traffic to an appliance ENI or NLB.

Design patterns and trade-offs

End-to-end encryption with mutual TLS where the load balancer must not terminate TLS requires a Layer 4 pass-through pattern. Use a Network Load Balancer (NLB) in front of backend pods so the TLS session is negotiated directly with the service endpoints. In Kubernetes on EKS, deploy a Service of type LoadBalancer backed by an NLB and register pods as targets by IP; the AWS Load Balancer Controller or legacy Service annotations ensure target type is IP and the target group protocol is TCP. For high concurrency characteristic of gRPC and many long-lived HTTP/2 connections, NLB preserves source IPs and imposes lower per-connection overhead than L7 proxies. If TLS termination at the ALB is required (e.g., for URL-based routing), you must terminate TLS at the ALB using an ACM certificate and then forward to backends; preserve client IP by relying on X-Forwarded-For (ALB) or by using a Proxy Protocol v2-capable NLB for backends that need original source IP at L4.

For multi-account, multi-VPC scalable architectures where central services are required, PrivateLink (AWS VPC Endpoint Services) is the most secure and scalable choice. Expose central services from the shared-services VPC as an AWS PrivateLink endpoint service. Each consumer account creates an interface VPC endpoint to that service; the service owner can require endpoint acceptance and apply security-group-based controls on the endpoint ENIs. This model keeps traffic on the AWS network, avoids peering scale limits, and provides per-consumer granular security. Transit Gateway with segmentation and Network Firewall can be used for network-level transit and central inspection, but it is more appropriate when full-routed connectivity with complex routing policies is required rather than per-service isolation.

When diagnosing bandwidth usage across multiple VIFs on Direct Connect, prioritize metadata first: enable and query VPC Flow Logs aggregated to S3 or CloudWatch and analyze via Athena to map high-volume IP flows to specific VPCs and subnets. Complement flow logs with CloudWatch metrics for the Direct Connect virtual interfaces, and if you need payload-level inspection or heterogeneous protocols, deploy Traffic Mirroring to capture packets to an EC2-based IDS. Traffic Mirroring is heavy and incurs cost; use it only for sessions/windows where flow logs and GuardDuty findings are insufficient.

Common pitfalls and decision criteria

A common mistake is relying on security groups alone for broad perimeter enforcement and not using NACLs or Network Firewall where subnet-level or stateful inspection is required. Security groups are per-ENI and easy to manage, but they do not scale well as a centralized control plane for many VPCs in different accounts; use AWS Firewall Manager to centralize WAF and Network Firewall rules across accounts. Another pitfall is terminating TLS at the load balancer without accounting for client IP preservation; ALB inserts X-Forwarded-For headers, but application logging must explicitly read that header and trust must be established (e.g., only ALB should send it). For strict assurance that only Global Accelerator can reach an ALB, avoid relying solely on DNS; instead, restrict ALB listeners via security groups to the accelerator’s published IP ranges (automate updates with the ip-ranges.json or managed prefix lists) or use an internal-only ALB where possible and front it with the accelerator endpoint.

Decide between PrivateLink and Transit Gateway by weighing service granularity versus full-mesh routing. PrivateLink provides per-service access control with security-group-level filtering and scales without exploding routing tables; Transit Gateway is necessary when you need route-based connectivity between many VPCs and on-premises networks and when you require centralized packet inspection with AWS Network Firewall. For high throughput, favor stateless Network Firewall rules at the perimeter combined with targeted stateful groups for critical flows; stateless processing scales but loses protocol awareness.

Practical Problem: Use-Case Scenario

Named company: Meridian Payments — challenge: enable a gRPC-based payments API on EKS requiring mutual TLS end-to-end (no TLS termination in the path), support thousands of concurrent long-lived connections, autoscaling of pods, and identification of originating client IPs for logging and fraud detection.

1. Approach: Deploy an Amazon Network Load Balancer in front of the EKS Service configured for target type IP so pod ENIs are registered directly with the NLB target groups. Use the AWS Load Balancer Controller to create an NLB-backed Service with annotations to ensure the target group protocol is TCP on 443 and health checks use TCP. Terminate mTLS at the backend pods; configure Istio or a sidecar TLS library if you need standardized certificate rotation, using Kubernetes Secrets populated from AWS Certificate Manager Private Certificate Authority or AWS Secrets Manager. Preserve client IPs because NLB preserves the source IP; ensure backend pod networkPolicy and security group rules allow the source ranges from NLB/clients. Use HPA and Cluster Autoscaler to scale pods; ensure target group deregistration delay is tuned to allow graceful connection draining.

2. Observability and forensic approach: Enable VPC Flow Logs for the EKS VPC to CloudWatch Logs and aggregate to S3 via Kinesis Firehose for retention and Athena queries mapping high-bandwidth flows. Enable GuardDuty for anomaly detection on VPC flows and DNS. If deeper packet inspection is required during suspected fraud windows, create Traffic Mirror sessions on the problematic ENIs to an EC2 sensor running Suricata; manage mirror filters to capture only relevant traffic to limit cost.

AWS rationale: NLB provides L4 pass-through so TLS and mTLS are negotiated end-to-end and the backend sees the true client IP, which satisfies the requirement that traffic is not decrypted by intermediate proxies and that logging/fraud analysis sees the original source. Registering pods by IP and using AWS Load Balancer Controller integrates with EKS autoscaling. VPC Flow Logs, GuardDuty, and Traffic Mirroring provide graduated visibility from metadata to full-packet capture for scalable, cost-effective compliance and incident response.

← Load Balancing and Traffic Management · All domains · Content Delivery and Edge Networking →

Practice these questions → · Timed practice on ExamRoll.io →

Browse Amazon →