AWS Security Groups

AWS Security Groups provide stateful, instance-level network access control for inbound and outbound traffic. They act as virtual firewalls that control which traffic can reach or leave associated AWS resources.

A security group is attached to supported AWS resources, commonly EC2 instances, and contains rules that allow traffic based on properties such as protocol, port, and source or destination. Security groups do not contain explicit deny rules; traffic that is not allowed by a rule is rejected.

Security groups are stateful. When an allowed connection is established, return traffic is automatically permitted without requiring a separate inbound or outbound rule for the response. This makes them different from stateless network ACLs.

Inbound rules control traffic entering the associated resource, while outbound rules control traffic leaving it. Rules can reference IP address ranges, other security groups, or other supported sources and destinations, depending on the AWS resource and rule configuration.

A resource can be associated with multiple security groups. The effective permissions are additive: traffic allowed by any associated security group is allowed. This means adding another security group does not create a narrower intersection of permissions.

Key points

• Security groups are stateful virtual firewalls.
• They use allow rules; there are no explicit deny rules.
• Inbound and outbound traffic are controlled separately.
• Return traffic for an allowed connection is automatically permitted.
• Multiple attached security groups combine their allowed traffic.

Interview questions

What is an AWS Security Group?

An AWS Security Group is a virtual firewall for supported AWS resources such as EC2 instances. It defines allowed inbound and outbound network traffic using rules such as protocol, port, and source or destination. Security groups do not have explicit deny rules. Traffic that is not permitted by an applicable rule is rejected.

Why are AWS Security Groups called stateful?

Stateful behavior means the security group tracks the state of permitted connections. If an inbound connection is allowed, the corresponding response traffic is automatically allowed back without needing a separate rule for that response. The same principle applies to allowed outbound connections and their return traffic.

What happens if an EC2 instance has multiple security groups?

The rules from the associated security groups are effectively combined. If any applicable rule allows the traffic, that traffic is permitted. Therefore, attaching an additional security group can expand the set of allowed traffic rather than restrict it. Security groups do not form an allow-list intersection.

How would you configure an application server so only a load balancer can reach its application port?

I would place the application server in a security group that allows the application port only from the security group associated with the load balancer, rather than allowing the whole internet. The load balancer's security group would separately permit the intended client traffic. This creates a network-level boundary between clients, the load balancer, and the backend. I would also keep administrative access, such as SSH, restricted to an explicitly required source.