{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/design-both-directions-of-stateless-aws-network-acl-rules/", "item": { "id": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/", "slug": "design-both-directions-of-stateless-aws-network-acl-rules", "url": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules.md", "json": "https://update.dsesecurity.com/api/v1/posts/design-both-directions-of-stateless-aws-network-acl-rules/" }, "title": "Design both directions of stateless AWS network ACL rules", "summary": "Include return paths and rule order when filtering at the subnet boundary.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:54+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 263, "potentially_affected": "This applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.", "dse_recommendation": "DSE recommends documenting both packet directions for each required application exchange before editing an ACL.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Include return paths and rule order when filtering at the subnet boundary.

\n

Source facts

\n

A VPC network ACL evaluates numbered inbound and outbound allow or deny rules in ascending order and uses the first match. ACLs are stateless, so an allowed request does not automatically permit its response. AWS evaluates them when traffic enters or leaves a subnet, not while traffic stays within that subnet.

\n

Source: AWS Documentation.

\n

Applicability

\n

This applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.

\n

DSE recommendation

\n

DSE recommends documenting both packet directions for each required application exchange before editing an ACL. Include the actual client return-port behavior and preserve space in rule numbering for later changes. Review the subnet association and existing first-match rules rather than adding a late allow that an earlier deny already defeats. Keep the old ACL configuration and a tested management route available. Coordinate the change with security-group and routing owners so a single failed request does not cause unrelated controls to be widened. Have the reviewer walk one permitted request and its response through the numbered rules before the change. Keep the expected first match for each direction in the evidence, and identify which independent control would still block an intentionally denied test flow.

\n

Verification

\n

Proposed verification: test an approved request and its response across the subnet boundary, then inspect the expected first-match rule in each direction. Include a deliberately denied flow. Record observed source, destination and port values instead of assuming every client uses the same ephemeral range.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Include return paths and rule order when filtering at the subnet boundary.\nSource facts\nA VPC network ACL evaluates numbered inbound and outbound allow or deny rules in ascending order and uses the first match. ACLs are stateless, so an allowed request does not automatically permit its response. AWS evaluates them when traffic enters or leaves a subnet, not while traffic stays within that subnet.\nSource: AWS Documentation.\nApplicability\nThis applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.\nDSE recommendation\nDSE recommends documenting both packet directions for each required application exchange before editing an ACL. Include the actual client return-port behavior and preserve space in rule numbering for later changes. Review the subnet association and existing first-match rules rather than adding a late allow that an earlier deny already defeats. Keep the old ACL configuration and a tested management route available. Coordinate the change with security-group and routing owners so a single failed request does not cause unrelated controls to be widened. Have the reviewer walk one permitted request and its response through the numbered rules before the change. Keep the expected first match for each direction in the evidence, and identify which independent control would still block an intentionally denied test flow.\nVerification\nProposed verification: test an approved request and its response across the subnet boundary, then inspect the expected first-match rule in each direction. Include a deliberately denied flow. Record observed source, destination and port values instead of assuming every client uses the same ephemeral range.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Include return paths and rule order when filtering at the subnet boundary.\n\n## Source facts\n\nA VPC network ACL evaluates numbered inbound and outbound allow or deny rules in ascending order and uses the first match. ACLs are stateless, so an allowed request does not automatically permit its response. AWS evaluates them when traffic enters or leaves a subnet, not while traffic stays within that subnet.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html).\n\n## Applicability\n\nThis applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.\n\n## DSE recommendation\n\nDSE recommends documenting both packet directions for each required application exchange before editing an ACL. Include the actual client return-port behavior and preserve space in rule numbering for later changes. Review the subnet association and existing first-match rules rather than adding a late allow that an earlier deny already defeats. Keep the old ACL configuration and a tested management route available. Coordinate the change with security-group and routing owners so a single failed request does not cause unrelated controls to be widened. Have the reviewer walk one permitted request and its response through the numbered rules before the change. Keep the expected first match for each direction in the evidence, and identify which independent control would still block an intentionally denied test flow.\n\n## Verification\n\nProposed verification: test an approved request and its response across the subnet boundary, then inspect the expected first-match rule in each direction. Include a deliberately denied flow. Record observed source, destination and port values instead of assuming every client uses the same ephemeral range.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/", "url": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Design both directions of stateless AWS network ACL rules", "item": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/#article", "identifier": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/", "url": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/", "headline": "Design both directions of stateless AWS network ACL rules", "description": "Include return paths and rule order when filtering at the subnet boundary.", "abstract": "Include return paths and rule order when filtering at the subnet boundary.", "articleBody": "Include return paths and rule order when filtering at the subnet boundary.\nSource facts\nA VPC network ACL evaluates numbered inbound and outbound allow or deny rules in ascending order and uses the first match. ACLs are stateless, so an allowed request does not automatically permit its response. AWS evaluates them when traffic enters or leaves a subnet, not while traffic stays within that subnet.\nSource: AWS Documentation.\nApplicability\nThis applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.\nDSE recommendation\nDSE recommends documenting both packet directions for each required application exchange before editing an ACL. Include the actual client return-port behavior and preserve space in rule numbering for later changes. Review the subnet association and existing first-match rules rather than adding a late allow that an earlier deny already defeats. Keep the old ACL configuration and a tested management route available. Coordinate the change with security-group and routing owners so a single failed request does not cause unrelated controls to be widened. Have the reviewer walk one permitted request and its response through the numbered rules before the change. Keep the expected first match for each direction in the evidence, and identify which independent control would still block an intentionally denied test flow.\nVerification\nProposed verification: test an approved request and its response across the subnet boundary, then inspect the expected first-match rule in each direction. Include a deliberately denied flow. Record observed source, destination and port values instead of assuming every client uses the same ephemeral range.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:54+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/design-both-directions-of-stateless-aws-network-acl-rules/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Design both directions of stateless AWS network ACL rules" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 263, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html" } } ] } }