title: Key use case differences of using AWS security group and Network ACL
body: <p>I know the stateful/stateless nature of Network ACL and Security Group; and I also know Network ACL is associated to subnet(s) whereas Security Group is associated to instance(s).</p>
  
  <p>The above two are most noticeable difference where we should encode our security policy in.</p>
  
  <p>However, are there any use cases that we can clearly see one is better than the other?</p>
  
  <p>For example, right now, I am thinking of lock-down the bastion host's network security. I can encode it into a security group sg_A {only allow 22 from a set of know IP ranges for the ingress traffic} and associate sg_A to the bastion instance. I can also encode it into a network ACL net_acl_B {only allow 22 from a set of know IP ranges for the ingress traffic} and associate net_acl_B to the subnet that the bastion instance is located.</p>