Design both directions of stateless AWS network ACL rules

Include return paths and rule order when filtering at the subnet boundary.

Source facts

A VPC network ACL evaluates numbered inbound and outbound allow or deny rules in ascending order and uses the first match. ACLs are stateless, so an allowed request does not automatically permit its response. AWS evaluates them when traffic enters or leaves a subnet, not while traffic stays within that subnet.

Source: AWS Documentation.

Applicability

This applies to VPC subnet ACL design, with the documented exclusions for metadata, DNS and other special traffic.

DSE recommendation

DSE recommends documenting both packet directions for each required application exchange before editing an ACL. Include the actual client return-port behavior and preserve space in rule numbering for later changes. Review the subnet association and existing first-match rules rather than adding a late allow that an earlier deny already defeats. Keep the old ACL configuration and a tested management route available. Coordinate the change with security-group and routing owners so a single failed request does not cause unrelated controls to be widened. Have the reviewer walk one permitted request and its response through the numbered rules before the change. Keep the expected first match for each direction in the evidence, and identify which independent control would still block an intentionally denied test flow.

Verification

Proposed verification: test an approved request and its response across the subnet boundary, then inspect the expected first-match rule in each direction. Include a deliberately denied flow. Record observed source, destination and port values instead of assuming every client uses the same ephemeral range.

Official reference

AWS Documentation. Reviewed October 20, 2026.