Understanding AWS Security Groups with Examples

Project Goal

• Learn what AWS Security Groups are
• Create custom security groups
• Understand traffic rules (inbound and outbound)
• Apply them to EC2 instances
• See how security groups control network access

What Are Security Groups?

Security Groups are like virtual firewalls for your EC2 instances. They control what traffic is allowed in and out of your servers.

Key points:

1. Resource-level protection: Security Groups are attached directly to an EC2 instance (or other resources), not to the subnet or VPC. This means each server can have its own firewall rules, independent of others in the same network.
2. Stateful behaviour: Security Groups are stateful, which means:

• If you allow incoming traffic on a port, the response traffic is automatically allowed back, even if there is no explicit outbound rule for it.
• Example:
• You allow SSH (port 22) inbound from your IP.
• When you connect via SSH, the server can send responses back to your computer without adding an outbound rule.

3. Security Groups only support allow rules. Any traffic that is not explicitly allowed is automatically blocked.

Think of a security group like the doorman of a building.

1. Think of a security group like the doorman of a building.
2. Resource level protection Each EC2 instance is like a separate apartment in the building. The security group is the doorman for that specific apartment, not the whole building. This means each apartment can have its own rules about who can come in or go out.
3. Stateful behaviour Imagine you invite a friend (incoming traffic) to your apartment for dinner. Because you invited them in, it is automatically okay for them to leave afterward. You do not need to give them a separate permission to leave. This is how stateful works.

Example: You allow visitors on the main door (SSH or HTTP). When visitors arrive, the doorman lets them in. When they leave, they are allowed out automatically, no extra rules needed.

3. Only allow rules Anything not explicitly allowed is blocked. No one can sneak in unless you give permission.

Here’s how to create and configure a security group for your EC2 instance.

Step 1: Go to the Security Groups Dashboard

1. Log in to the AWS Management Console
2. Search for EC2 → click Security Groups under Network & Security

Step 2: Create a Custom Security Group

1. Click Create Security Group
2. Name it: first-sg
3. Description: Allows HTTP, SSH access for web server
4. VPC: select your existing/default VPC

Step 3: Configure Inbound Rules

SSH (Secure Shell)

• Port 22 is used to securely connect to your EC2 instance from your computer.
• Source = My IP ensures that only your machine can log in, keeping your server safe from others.
• Think of SSH as the key that lets you access your server remotely.

HTTP (Hypertext Transfer Protocol)

• Port 80 is the standard port for web traffic.
• Source = Anywhere (0.0.0.0/0) allows anyone on the internet to access your website.
• Without this rule, your server’s web page would not be visible to visitors.

Step 4: Configure Outbound Rules

• Default: All traffic allowed
• Optional: Restrict outbound if needed (for security or private subnets)

Outbound rules define where your instance can send traffic. Security groups are stateful, so return traffic is automatically allowed.

Step 5: Attach Security Group to an EC2 Instance

1. Go to EC2 → Instances
2. Select your instance
3. Click Actions → Security → Change Security Groups
4. Add first-sg and save

Now the instance follows the traffic rules you just defined.

To conclude, security Groups are the first line of defence for your AWS instances, and mastering them is essential for keeping your servers secure while allowing the right traffic.