The Farmlands of
Nkrumah Valley

Kojo's great farmland

Kojo Mensah inherited a vast stretch of land in Nkrumah Valley. The very first thing he did was mark its boundary with sturdy wooden fencing — every grain of soil inside belongs to him.

Outside the boundary is the village; inside is Kojo's world. Nothing on his farm touches anything outside it unless Kojo personally allows it.

One farm, two sections

Kojo divides his land. The section near the road becomes the public farm — that's where he sells maize and yam to passers-by. The section deep inside, hidden behind the trees, is the private farm — that's where his most valuable cassava and family granary live.

Same farm, different purposes, different rules. The road can see one. The road cannot see the other.

Strict gates at every entrance

Kojo builds a wooden gate at the entrance of each section. Every gate has the same printed list of rules: men in blue uniforms get in, anyone in red gets turned away. No exceptions. No questions. No favoritism.

The gate doesn't know your name. It only knows the rules. If you don't fit them, you don't pass.

StatelessA NACL checks every single packet against its rules — both incoming AND outgoing — independently. · Rule-based · Subnet-level

Smart guards at each building

Inside the subnet, each important building has its own personal guard. The granary has one. The farmhouse has one. They aren't standing at the section gate — they're standing right at the door.

These guards are smarter than the gatekeeper. They don't follow a generic list — each one knows exactly which visitors their specific building expects.

If a visitor passed the section gate, they STILL have to convince the guard at the building. Two layers of safety.

"Only escorted by Ama's guards"

Across the valley, Kojo's friend Ama also has guards on her farm. One day, Kojo tells his guard at the granary something powerful:

"You don't need to recognize every face. If a visitor walks in escorted by an Ama-guard, that's enough. Let them in."

Now Kojo's guard doesn't check IPs or addresses. He just looks at the badge of the escort. One Security Group references another — pure trust based on identity, not geography.

This is the most powerful pattern in AWS networking. It's how web servers talk to databases without ever exposing the database to the world.

The guard remembers you

Here's where it gets clever. When Ama walks into Kojo's granary, the guard checks her in carefully. He writes her name down.

When Ama walks BACK OUT? The guard doesn't ask any questions. He saw her come in. He remembers. The exit is automatic.

This is what makes Security Groups statefulStateful means the system tracks active connections — incoming requests are checked, but matching return traffic is automatically allowed without re-checking the rules. — they remember every connection they've allowed and let the response back through automatically.

NACLs don't do this. They check every direction, every time. Like a guard who has dementia.

Two paths, two purposes

The public farm has a gate that opens directly to the road. Strangers can walk in and buy maize. The whole point is to be reached.

The private farm has no road access. To get there, you must first enter via the public farm's path, walk THROUGH it, and then take a small inner trail to the granary. There's no shortcut from the outside world.

That's exactly how AWS works. Public subnets have a route to the internet (an Internet Gateway). Private subnets don't — they reach the world only through a public subnet's NAT.