Amazon EC2 Security Groups: Stateful Instance Firewalls

When an EC2 instance cannot be reached, the first question is often whether the security group allows the traffic. A security group is a virtual firewall attached to a resource’s network interface. It controls which inbound traffic may reach the resource and which outbound traffic may leave it.

This is Part 17 of the AWS Cloud Practitioner Study Notes series. Part 16 covered EC2 instance families and lifecycle states, while Part 18 puts security groups into the wider VPC network model.

What a security group controls

A security group evaluates traffic using allow rules. A rule can describe:

• Protocol, such as TCP, UDP, or ICMP
• Port or port range, such as 22, 80, or 443
• Source for inbound traffic
• Destination for outbound traffic
• An IPv4 CIDR block, IPv6 CIDR block, prefix list, or another security group

Security groups control traffic to and from associated resources. They do not choose the network path. Route tables, gateways, endpoints, and other VPC components determine whether a packet has a route; the security group then determines whether the matching traffic is allowed.

For example, opening TCP port 443 in a security group does not make an instance internet-accessible by itself. The subnet still needs an appropriate route, the VPC needs connectivity, and the instance needs a public or private path that matches the intended architecture.

Inbound and outbound rules

Inbound rules

Inbound rules answer:

Who can connect to this resource, using which protocol and port?

Examples:

• Allow TCP 22 from an administrator’s public IP for Linux SSH access.
• Allow TCP 3389 from an administrator’s IP for Windows RDP access.
• Allow TCP 443 from the internet for a public HTTPS endpoint.
• Allow TCP 3306 from the application server’s security group for MySQL access.

Outbound rules

Outbound rules answer:

Where can this resource connect, using which protocol and port?

For example, an EC2 instance might be allowed to make HTTPS connections to external services or to reach Amazon S3 through a suitable VPC route or endpoint.

New security groups start with no inbound rules and a default outbound rule that allows all traffic. You can remove that outbound rule and replace it with narrower rules. If a security group has no outbound rules, outbound traffic is not allowed by that security group.

The default VPC security group has special behaviour: its inbound rule permits traffic from resources associated with the same default security group. Do not confuse that special default-group rule with the normal exam shorthand that a newly created security group denies inbound traffic until you add a rule.

Security groups are stateful

Stateful means that AWS tracks the connection. If an inbound request is allowed, the response traffic is automatically allowed back, even if there is no matching outbound rule for that response. Likewise, if an outbound connection is allowed, the response can return without adding a separate inbound response rule.

Example:

1. A client sends an HTTPS request to TCP port 443.
2. The security group allows the inbound request.
3. The EC2 application sends the response.
4. The response is allowed because it belongs to the tracked connection.

This is a key difference from a stateless Network ACL, where the return direction must be allowed separately.

Common ports to remember

Port	Common service	Typical use
22	SSH	Linux administration
3389	RDP	Windows administration
80	HTTP	Unencrypted web traffic
443	HTTPS	Encrypted web traffic
3306	MySQL	MySQL database connections
5432	PostgreSQL	PostgreSQL database connections

Opening a port to 0.0.0.0/0 allows traffic from every IPv4 address. Opening a port to ::/0 allows traffic from every IPv6 address. Use the narrowest source range that meets the requirement, especially for administration ports.

Referencing another security group

A security group rule can use another security group as its source or destination. This is usually safer and more maintainable than putting the changing private IP addresses of application instances into a database rule.

Consider a two-tier application:

Resource	Rule	Source
Web servers	TCP 80 and 443	Required client range or load balancer
Database	TCP 3306	sg-web

The database security group allows MySQL only from resources associated with sg-web. The database does not need to accept port 3306 from the whole internet.

Security-group references work through private IP addresses and require suitable connectivity between the resources. In a common same-VPC design, both security groups are associated with resources in that VPC. Security-group references can also be supported across certain peering or Transit Gateway arrangements, subject to AWS’s rules and the network routes being configured.

Multiple security groups

An EC2 instance can have multiple security groups. AWS aggregates the allow rules from all attached groups into one effective set of permissions.

For example:

• sg-web-common allows HTTPS.
• sg-monitoring allows the monitoring system to reach its agent port.
• sg-administration allows SSH from a controlled administrator range.

If any attached security group allows a packet, the security-group layer allows it. There are no explicit deny rules that override another attached group. If you need to block a particular source IP, use a Network ACL or another appropriate network-security control instead of trying to create a deny rule in a security group.

Security group versus Network ACL

This comparison appears frequently in Cloud Practitioner questions:

Characteristic	Security group	Network ACL
Scope	Resource or network interface	Subnet
State	Stateful	Stateless
Rule types	Allow only	Allow and deny
Return traffic	Automatically allowed for tracked connections	Must be allowed separately
Typical role	Primary resource-level firewall	Subnet-level guardrail or explicit deny control

A security group is usually the first control to check for an EC2 connectivity problem. A NACL can still block the traffic before it reaches the resource, so both layers must permit the connection. Routing must also be correct.

Practical security-group patterns

Linux administration

Allow TCP 22 only from the administrator’s current public IP, preferably through a controlled access path. Avoid opening SSH to 0.0.0.0/0 unless there is a specific, reviewed reason.

Public web application

Allow TCP 80 and 443 from the intended public client ranges. If IPv6 is enabled, create the corresponding IPv6 rules deliberately rather than assuming an IPv4 rule covers IPv6.

Private database

Allow the database port only from the application tier’s security group. Keep the database in a private subnet and do not add a broad internet source merely to make application connectivity work.

Monitoring or internal services

Allow the required agent or API port from the monitoring service’s security group or private CIDR range. A security-group reference expresses the application relationship more clearly than a list of instance addresses.

Troubleshooting an unreachable EC2 instance

Check the layers in this order:

1. Is the instance running and passing its status checks?
2. Does the subnet route table provide a route to the client or destination?
3. Does the Internet Gateway, NAT Gateway, VPC endpoint, peering connection, or Transit Gateway match the intended path?
4. Does the instance have the required public, private, or Elastic IP address?
5. Does the security group allow the correct protocol, port, and source or destination?
6. Does the subnet’s NACL allow both directions when required?
7. Is the operating system firewall or application listener allowing the connection?

This avoids treating a security group as a routing table. A correct port rule cannot fix a missing route, an absent public IP, a stopped instance, or an application that is not listening.

Common CLF-C02 exam cues

• Virtual firewall for an EC2 instance: Security group
• Controls inbound and outbound traffic: Security group
• Stateful firewall: Security group
• Allow rules only: Security group
• Block one malicious IP with an explicit deny: Network ACL
• SSH: TCP port 22
• HTTPS: TCP port 443
• Only web servers can access a database: Reference the web-server security group
• No inbound rule exists: Inbound traffic is denied by that security group
• Response traffic needs a separate return rule: Not for a stateful security group

Conclusion

Security groups are stateful, allow-only firewalls applied at the resource or network-interface level. They protect inbound and outbound traffic, aggregate rules across multiple attached groups, and can reference other security groups to express application-tier relationships.

Remember the boundary: security groups filter traffic, but route tables and gateways determine whether traffic has a path. For the exam, pair the words stateful, instance-level, and allow-only with Security Groups; pair stateless, subnet-level, and deny rules with Network ACLs.

Sources

• Security group rules
• Control traffic to your AWS resources using security groups
• Create a security group for your VPC
• Security group rules for different use cases
• Control subnet traffic with network access control lists