# Security Groups — AWS

Source: https://www.geekswithgeeks.com/en/aws/aws-security-groups

> A virtual, stateful firewall attached to your instances.

## What a security group is

A **security group** is a virtual firewall attached to an EC2 instance's network interface, controlling inbound and outbound traffic by port, protocol, and source/destination.

## Stateful rules

Security groups are **stateful**: if you allow an inbound request, the response is automatically allowed out — you only write rules for one direction of a conversation.

## Avoid 0.0.0.0/0 on SSH

Opening port 22 to the whole internet (`0.0.0.0/0`) invites brute-force attacks. Restrict SSH to your own IP or a bastion host instead.

**Quiz:** If a security group allows inbound traffic on port 443, what happens to the response traffic?

- [ ] It's blocked unless a separate outbound rule allows it
- [x] It's automatically allowed because security groups are stateful
- [ ] It depends on the instance's operating system

*Answer:* It's automatically allowed because security groups are stateful. Stateful means the return traffic of an allowed request is automatically permitted, regardless of outbound rules.