SGのルール削除をしても通信が切れない！Connection Trackingを検証してみた

AWSTemplateFormatVersion: "2010-09-09"
Description: >
  SG Connection Tracking verification environment.
  No public IP, no NAT Gateway, no IGW.
  Access via EC2 Instance Connect Endpoint / dnf via S3 Gateway Endpoint.

Parameters:
  LatestAmiId:
    Type: AWS::SSM::Parameter::Value<AWS::EC2::Image::Id>
    Default: /aws/service/ami-amazon-linux-latest/al2023-ami-kernel-default-x86_64
  InstanceType:
    Type: String
    Default: t3.micro
  TestPort:
    Type: Number
    Default: 5000

Resources:
  VPC:
    Type: AWS::EC2::VPC
    Properties:
      CidrBlock: 10.0.0.0/16
      EnableDnsSupport: true
      EnableDnsHostnames: true
      Tags:
        - Key: Name
          Value: conntrack-vpc

  SubnetClient:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.1.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: conntrack-subnet-client

  SubnetServer:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.2.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: conntrack-subnet-server

  SubnetMgmt:
    Type: AWS::EC2::Subnet
    Properties:
      VpcId: !Ref VPC
      CidrBlock: 10.0.3.0/24
      AvailabilityZone: !Select [0, !GetAZs ""]
      MapPublicIpOnLaunch: false
      Tags:
        - Key: Name
          Value: conntrack-subnet-mgmt

  RouteTable:
    Type: AWS::EC2::RouteTable
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: conntrack-rtb

  RtbAssocClient:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SubnetClient
      RouteTableId: !Ref RouteTable

  RtbAssocServer:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SubnetServer
      RouteTableId: !Ref RouteTable

  RtbAssocMgmt:
    Type: AWS::EC2::SubnetRouteTableAssociation
    Properties:
      SubnetId: !Ref SubnetMgmt
      RouteTableId: !Ref RouteTable

  S3GatewayEndpoint:
    Type: AWS::EC2::VPCEndpoint
    Properties:
      VpcId: !Ref VPC
      ServiceName: !Sub com.amazonaws.${AWS::Region}.s3
      VpcEndpointType: Gateway
      RouteTableIds:
        - !Ref RouteTable

  NaclServer:
    Type: AWS::EC2::NetworkAcl
    Properties:
      VpcId: !Ref VPC
      Tags:
        - Key: Name
          Value: conntrack-nacl-server

  NaclServerInboundAllowAll:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref NaclServer
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      Egress: false
      CidrBlock: 0.0.0.0/0

  NaclServerOutboundAllowAll:
    Type: AWS::EC2::NetworkAclEntry
    Properties:
      NetworkAclId: !Ref NaclServer
      RuleNumber: 100
      Protocol: -1
      RuleAction: allow
      Egress: true
      CidrBlock: 0.0.0.0/0

  NaclAssocServer:
    Type: AWS::EC2::SubnetNetworkAclAssociation
    Properties:
      SubnetId: !Ref SubnetServer
      NetworkAclId: !Ref NaclServer

  SgEic:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: EC2 Instance Connect Endpoint
      VpcId: !Ref VPC
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 10.0.0.0/16
          Description: SSH to instances in VPC
      Tags:
        - Key: Name
          Value: conntrack-sg-eic

  SgClient:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Client instance
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          SourceSecurityGroupId: !Ref SgEic
          Description: SSH from EIC Endpoint
      Tags:
        - Key: Name
          Value: conntrack-sg-client

  SgServer:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Server instance (verification target)
      VpcId: !Ref VPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          SourceSecurityGroupId: !Ref SgEic
          Description: SSH from EIC Endpoint
        - IpProtocol: tcp
          FromPort: !Ref TestPort
          ToPort: !Ref TestPort
          SourceSecurityGroupId: !Ref SgClient
          Description: Test traffic from client
      Tags:
        - Key: Name
          Value: conntrack-sg-server

  EicEndpoint:
    Type: AWS::EC2::InstanceConnectEndpoint
    Properties:
      SubnetId: !Ref SubnetMgmt
      SecurityGroupIds:
        - !Ref SgEic
      PreserveClientIp: false
      Tags:
        - Key: Name
          Value: conntrack-eic

  ClientInstance:
    Type: AWS::EC2::Instance
    DependsOn:
      - S3GatewayEndpoint
      - RtbAssocClient
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      SubnetId: !Ref SubnetClient
      SecurityGroupIds:
        - !Ref SgClient
      CreditSpecification:
        CPUCredits: standard
      UserData:
        Fn::Base64: |
          #!/bin/bash
          dnf install -y nmap-ncat tcpdump
      Tags:
        - Key: Name
          Value: conntrack-client

  ServerInstance:
    Type: AWS::EC2::Instance
    DependsOn:
      - S3GatewayEndpoint
      - RtbAssocServer
      - NaclAssocServer
    Properties:
      ImageId: !Ref LatestAmiId
      InstanceType: !Ref InstanceType
      SubnetId: !Ref SubnetServer
      SecurityGroupIds:
        - !Ref SgServer
      CreditSpecification:
        CPUCredits: standard
      UserData:
        Fn::Base64: |
          #!/bin/bash
          dnf install -y nmap-ncat tcpdump
      Tags:
        - Key: Name
          Value: conntrack-server

Outputs:
  ClientInstanceId:
    Value: !Ref ClientInstance
  ServerInstanceId:
    Value: !Ref ServerInstance
  ServerPrivateIp:
    Value: !GetAtt ServerInstance.PrivateIp
  ClientPrivateIp:
    Value: !GetAtt ClientInstance.PrivateIp
  ServerSecurityGroupId:
    Value: !Ref SgServer
  ServerNaclId:
    Value: !Ref NaclServer