security groups
- What they are
- Virtual firewalls at the instance / ENI level inside a VPC.
- The defining properties
- Stateful — if you allow traffic in, the response is automatically allowed out (and vice versa). No return rule needed.
- Allow rules only — you cannot write a deny rule. Anything not explicitly allowed is denied.
- All rules are evaluated together before a decision is made.
- Can reference another security group as the source — the standard way to say “only the web tier may reach the database tier”.
- Multiple security groups can attach to one instance; the rules are the union.
- Defaults
- Default security group: all inbound denied, all outbound allowed.
- Contrast with network ACLs
- Security group → instance level, stateful, allow only.
- Network ACL → subnet level, stateless, allow and deny, rules evaluated in numbered order.
- They are layered defense: traffic must pass the NACL and the security group.