AWS Security Groups

Stateful filtering, inbound/outbound rules, port ranges, security group references as sources, and no-deny-rule model.

Overview

Overview AWS Security Groups are the primary layer of network access control for EC2 instances, RDS databases, Lambda functions in VPCs, ECS tasks, and most other AWS resources that have network interfaces (ENIs).

A security group is a stateful virtual firewall attached to an ENI. Stateful means that if you allow inbound traffic on port 443, the return traffic is automatically allowed without any outbound rule. The connection tracking is handled by the underlying hypervisor.

Security groups operate on an implicit-deny model: there are no explicit deny rules. All traffic is denied by default, and rules only add allow entries. You cannot write a security group rule that denies a specific IP. If you need explicit deny, use a Network ACL. By default, a new security group allows all outbound traffic.

The most powerful feature is the ability to use another security group as the source or destination of a rule. This means you can write rules like "allow port 3306 from anything in the web-tier security group" — as instances join or leave that group, the rule automatically applies without any IP management. This is the idiomatic AWS pattern for inter-tier communication.

Security groups are applied at the ENI level. A single ENI can have up to 5 security groups applied simultaneously. An instance can have multiple ENIs, each with its own set of security groups.

Key concepts

Stateful filtering
Return traffic for allowed connections is automatically permitted without an explicit outbound rule. Connection tracking happens at the hypervisor level. This is the key difference from NACLs, which require explicit rules in both directions.
Implicit deny model
All traffic is denied by default. Rules only ADD allow entries — there are no deny rules in security groups. To block specific traffic you must use NACLs or not add an allow rule.
Security group as source/destination
Instead of a CIDR range, a rule can reference another security group ID. Traffic from any ENI with that security group attached is allowed. This eliminates IP management for dynamic environments.
ENI attachment
Security groups are applied to Elastic Network Interfaces. Up to 5 security groups per ENI, up to 60 inbound and 60 outbound rules per security group (default, adjustable via Service Quotas).
Default security group
Every VPC has a default security group that allows all inbound from itself and all outbound. Avoid using the default in production; create named, purpose-specific security groups.

When to use it

  • Designing security group rules for a three-tier web application (ALB, EC2, RDS)
  • Explaining the difference between security groups and NACLs
  • Troubleshooting connectivity between EC2 instances in the same VPC
  • Implementing least-privilege network access for microservices in ECS
  • Auditing security group rules for overly permissive access (0.0.0.0/0 on sensitive ports)

Interview questions

  • Design security groups for a three-tier application: ALB, EC2 web tier, and RDS database.
  • What is the difference between security groups and NACLs? When do you need both?

Sign up free to read the full topic

More Networking topics

Start free on Cariara · Coding problems · System design studio