title: “VPC Security Groups” created: 2026-07-22 updated: 2026-07-22 type: knowledge tags:
- aws
- certification
- networking
- vpc
- security
VPC Security Groups
What It Is
A Security Group is a stateful virtual firewall that controls inbound and outbound traffic at the instance level (ENI level). It is the primary mechanism for controlling network access to AWS resources within a VPC.
Why It Matters
Security groups are the first line of defense for individual resources. They are used everywhere — EC2, RDS, Lambda (VPC mode), ELB, etc. Understanding their behavior is fundamental to AWS networking and security.
Key Concepts
Characteristics
- Operates at the instance level (technically at the ENI — Elastic Network Interface)
- Stateful — if you allow inbound traffic, the response is automatically allowed outbound (and vice versa)
- Allow rules only — you cannot create deny rules; anything not explicitly allowed is implicitly denied
- All rules are evaluated together (no priority/ordering)
- Up to 5 security groups per instance (default)
Default Security Group
Every VPC comes with a default security group with these rules:
| Direction | Rule | Effect |
|---|---|---|
| Inbound | Source = self (same SG) | Allow all traffic from instances in the same SG |
| Inbound | All other sources | Deny (implicit) |
| Outbound | All destinations | Allow all traffic |
The self-referencing inbound rule means: instances sharing this security group can communicate freely with each other, but nothing else can reach them.
Custom Security Groups
When you create a new security group:
- No inbound rules (all inbound denied by default)
- All outbound allowed by default
- You add rules to permit specific traffic
Rule Components
| Field | Description | Example |
|---|---|---|
| Type | Protocol/port preset | HTTP, SSH, Custom TCP |
| Protocol | TCP, UDP, ICMP | TCP |
| Port range | Port(s) to allow | 80, 443, 22 |
| Source/Destination | CIDR, IP, or another SG | 0.0.0.0/0, sg-abc123 |
Referencing Other Security Groups
Instead of using CIDR blocks, you can reference another security group as a source:
Inbound rule: Allow TCP 3306 from sg-webapp
This means “allow MySQL connections from any instance in the sg-webapp security group” — even as instances scale up/down, the rule stays valid.
Gotchas
- Security groups are stateful — no need to configure return traffic rules (unlike NACLs)
- You cannot deny specific traffic — only allow; for deny rules, use NACLs
- Changes to security group rules take effect immediately
- An instance can belong to multiple security groups — all rules are aggregated (union of all allows)
- Security groups are VPC-scoped — they cannot be shared across VPCs (unless using VPC peering with security group references in the same Region)
- If you remove all outbound rules, instances cannot initiate any outbound connections
See Also
- [[vpc-network-acls]]
- [[vpc-subnets]]
- [[vpc-fundamentals]]
- [[iam-policy-structure]]