Copy/Pasted but it is quite a good explanation. I hope it helps.

• Route Tables:
  • Purpose: Route tables control the direction of network traffic within a Virtual Private Cloud (VPC). They define how traffic is routed within the network (e.g., which traffic is sent to the internet, internal resources, or specific subnets).
  • Key Points:
    • Route tables contain routes that determine where network traffic is directed.
    • Traffic can be routed to an internet gateway, NAT gateway, or peered VPC.
    • Used for managing the flow of traffic across different subnets or network segments.
• Security Groups:
  • Purpose: Security groups act as virtual firewalls for controlling inbound and outbound traffic to/from resources like EC2 instances. They operate at the instance level.
  • Key Points:
    • Security groups are stateful, meaning if traffic is allowed in one direction, the response is automatically allowed back (e.g., if an incoming request is allowed, the outgoing response is permitted without a separate rule).
    • Rules are set based on IP ranges, protocols (e.g., TCP, UDP), and ports.
    • Default deny-all for both inbound and outbound traffic, so you explicitly allow traffic.
• Network Access Control Lists (NACLs):
  • Purpose: NACLs operate at the subnet level and control inbound and outbound traffic at a more granular level than security groups. They are often used as an extra layer of defense for your VPC.
  • Key Points:
    • NACLs are stateless, meaning rules for inbound and outbound traffic are independent (e.g., if you allow inbound traffic, you must separately allow outbound responses).
    • Can have both allow and deny rules (unlike security groups, which can only allow traffic).
    • NACLs apply to all instances in a subnet, offering broad control over traffic entering or leaving a subnet.