Status: IN
NACLs cannot filter DNS traffic to Route 53 Resolver, DHCP, instance metadata (IMDS), ECS task metadata, Windows license activation, Time Sync Service, or default VPC router reserved IPs.
Source: entries/2026/03/08/vpc-nacls.md
JSON