How will you differentiate between VPC security groups and VPC network ACLs?

 When we talk about the VPC security group, it is responsible for tracking only the allowed traffic in EC2 instance, which comes in and goes out from Amazon. VPC network ACLs is a lot different. They are responsible for tracking the traffic only at the subnet level i.e. the traffic coming in or going out of subnet. Network ACLs are unable to filter the traffic in the subnet between instances but can do stateless filtering and are used to set Allow and Deny rules. The security group on the other end can carry out stateful filtering.