Security Groups

Understand AWS security groups as stateful firewall rules for EC2, load balancers, databases, and other VPC resources.

Last reviewed: June 2026

·AWS CloudAWS CLI v2AWS SDKsAWS Well-Architected Framework
✅
Quick Understanding: Security Groups helps teams design, build, secure, operate, and troubleshoot AWS workloads. In enterprise projects, the important questions are ownership, blast radius, automation, observability, compliance, and cost.

🔍 What Is It?

A security group is a virtual firewall for AWS resources in a VPC.

It controls inbound and outbound traffic using allow rules. Security groups are stateful, so return traffic for allowed connections is automatically permitted.

🎯 Why Do We Need It?

Security groups enforce network least privilege.

They prevent direct exposure of application, database, and admin ports and help express which tiers are allowed to communicate.

Common developer mistakes:

  • →Choosing defaults without checking security, cost, or failure behavior
  • →Treating AWS services as isolated tools instead of part of an architecture
  • →Skipping tags, alarms, IAM review, backups, and runbooks until production incidents happen
  • →Building manually in the console and then struggling to reproduce environments

🏗️ What Happens in Real Projects?

A web app may use three security groups:

  • →ALB allows inbound HTTPS from the internet
  • →App allows inbound app port only from ALB security group
  • →DB allows inbound database port only from app security group

This creates tiered network access without hardcoding IPs.

⚙️ How It Works

Rules specify protocol, port, and source or destination. Sources can be CIDR ranges or other security groups.

Because security groups are stateful, you usually define inbound access carefully and keep outbound access controlled based on enterprise policy.

💻 Example

Tiered security group model — Rules for a private application behind an ALB.

text
alb-sg:
  inbound: 443 from 0.0.0.0/0
  outbound: app port to app-sg

app-sg:
  inbound: app port from alb-sg
  outbound: 5432 to db-sg, 443 to AWS endpoints

db-sg:
  inbound: 5432 from app-sg
  outbound: minimal required responses

🤔 Common Confusions

❓ Are security groups stateless?

No. Security groups are stateful. Network ACLs are stateless.

❓ Can security groups deny traffic?

Security groups only contain allow rules. Lack of allow means traffic is denied.

❓ Should I use IPs or security group references?

Use security group references for tier-to-tier access where possible because instances can scale and change IPs.

🚨 Common Production Issues

**0.0.0.0/0 on admin ports** exposes SSH, RDP, or databases to the internet.

**Too many broad outbound rules** allow unnecessary data exfiltration paths.

**IP-based app rules** break when Auto Scaling replaces instances.

**Rule sprawl** makes firewall intent impossible to audit.

✅ Best Practices

Allow only required inbound ports

Reference security groups between tiers

Avoid public admin access; use SSM or VPN patterns

Review broad CIDR rules regularly

Name security groups by application and tier

Use infrastructure as code for rule ownership

🏛️ Architect's Note

Senior Architect's Perspective

Security groups are one of the clearest expressions of architecture. If the rules are broad and confusing, the system boundaries are probably broad and confusing too.

💬 Frequently Asked Questions

Interview: How would you explain Security Groups in a real AWS project?

Security Groups should be explained through the business workload it supports, the AWS responsibility boundary, the failure modes, the security controls, and how it is monitored and automated.

Interview: What production mistake do developers commonly make with Security Groups?

The common mistake is using the service successfully in a lab but not designing for least privilege, multi-AZ resilience, alarms, cost visibility, and repeatable infrastructure.

What is the difference between security groups and NACLs?

Security groups are stateful resource-level controls. Network ACLs are stateless subnet-level controls.

Can one resource have multiple security groups?

Yes. The effective access is the union of allow rules across attached security groups.

🎯 Key Takeaways

1Security groups are stateful firewalls
2Rules allow traffic; missing allow denies traffic
3Security group references support scalable tier access
4Avoid public exposure of admin and database ports

🎯 Practice this topic in interviews

↗ Where this topic fits

Sources

Sources / References

Use these AWS references to verify the concept in official docs and continue into the most relevant SplashRide pages.