Lesson 8 / 26

Security Groups

A virtual, stateful firewall attached to your instances.

What a security group is

A security group is a virtual firewall attached to an EC2 instance's network interface, controlling inbound and outbound traffic by port, protocol, and source/destination.

Stateful rules

Security groups are stateful: if you allow an inbound request, the response is automatically allowed out — you only write rules for one direction of a conversation.

Avoid 0.0.0.0/0 on SSH

Opening port 22 to the whole internet (0.0.0.0/0) invites brute-force attacks. Restrict SSH to your own IP or a bastion host instead.

Quick check: If a security group allows inbound traffic on port 443, what happens to the response traffic?

  • It's blocked unless a separate outbound rule allows it
  • It's automatically allowed because security groups are stateful
  • It depends on the instance's operating system
Answer

It's automatically allowed because security groups are stateful — Stateful means the return traffic of an allowed request is automatically permitted, regardless of outbound rules.