Network ACLs section

Network ACLs work as a firewall on the subnet level. When creating the default VPC, the default network ACL is created. The default rules are described in the tables below. The picture shows possible network ACLs and security groups association options. For example, you can associate a network ACL with multiple subnets.

Ingress rules of the default Network ACL
Ingress rule Protocol Ports Source Rule action
100 All All Allow
32767 All All Deny
Egress rules of the default Network ACL
Egress rule Protocol Ports Source Rule action
100 All All Allow
32767 All All Deny

Creating a network ACL

Click button_1 to create a network ACL.

By clicking on the link with the network ACL ID you can see additional information, associate the network ACL with a subnet and configure rules.

Deleting a network ACL

Click button_2 to delete a network ACL. Network ACL will be deleted after your confirmation.


You can’t delete the default network ACL and a network ACL which is associated with a subnet.

Associating a network ACL

Click a link with network ACL unique ID and then click button_3 on the Subnets tab to associate a network ACL with a subnet. In the dialog window select the subnet with which you want to associate the network ACL and confirm the action.

Go to the Subnets section if you want to know with which network ACL the subnet is associated.


You can associate with network ACL no more than 200 subnets of each VPC.

Adding and modifying rules

Each network ACL contains a numbered list of ingress and egress rules that allow or deny traffic on the subnet level. Rules have priority, depending on the number: the smaller the rule number, the higher priority it has. The highest number that you can use for a rule is 32766. We recommend that you start by creating rules in increments of 100 so that you can insert new rules where you need to later on.


In one network ACL you can’t create two rules of the same direction with the same number. Also you can not create more than 20 rules of one direction.

You can control traffic on the subnet level by adding rules. To add an ingress or an egress rule, go to the corresponding tab, click button_3_1 and set necessary access parameters.

The adding an ingress rule dialog window is similar to the adding an egress rule one.


Allow rule don’t affect cross-AZ traffic. To allow such traffic, please use IP-based rules.

Click button_4 and make necessary changes in the dialog window, if you need to make changes to the rules.

After your confirmation new access parameters will be applied to the subnets, associated with the network ACL.

Deleting rules

Click button_5 in the corresponding tab to delete ingress or egress rules. Rules will be deleted after your confirmation. You can delete multiple rules at a time.