Question

A security engineer at a financial services company is troubleshooting connectivity for VMs in a VPC named 'prod-vpc'. There are three ingress firewall rules targeting the same instances by network tag 'app-tier': Rule A (priority 1000, allow TCP:443 from 0.0.0.0/0), Rule B (priority 900, deny TCP:443 from 203.0.113.0/24), and Rule C (priority 800, allow TCP:443 from 203.0.113.10/32). A partner system at 203.0.113.10 reports it cannot reach the app on port 443, while other internet clients connect successfully. What is the effective behavior and why?

Accepted Answer

The connection from 203.0.113.10 is allowed, because Rule C (priority 800) is evaluated first and permits that specific /32 source before the deny rule applies.

Answer

The connection from 203.0.113.10 is denied, because lower priority numbers are evaluated last, so Rule A's allow takes precedence over Rule C.

Answer

The connection from 203.0.113.10 is denied, because Rule B's deny at priority 900 overrides Rule A, and Rule C is ignored since deny rules always win.

Answer

The connection from 203.0.113.10 is allowed only if the implied allow-ingress rule is enabled, since custom rules with overlapping ranges cancel each other out.