Can a subnet be associated with multiple Access Control Lists (ACL)?

In AWS, a subnet can indeed be associated with only one Network Access Control List (ACL) at a time. This design ensures a simplified approach to managing traffic rules for the subnet. Each ACL acts as a firewall for controlling inbound and outbound traffic at the subnet level. When a subnet is associated with a specific ACL, all the incoming and outgoing traffic is evaluated against the rules defined in that ACL.

If you need to change the ACL governing a subnet, the existing ACL can be replaced with a different one, but at any given moment, only one ACL can be in effect for that subnet. This streamlined control enables better organization of security settings without the complexity of overlapping rules.

The other options suggest that a subnet can have multiple ACL associations, which would lead to conflicting rules and increased management complexity. This approach is contrary to AWS's architecture design principles, which focus on ease of use and clarity in resource permissions and access controls.