Security groups, inbound and outbound traffic

A 3-minute hand-drawn animated video with a voice and subtitles. Press play below, or open the .mp4 file.

TL;DR

A security group is a guard at your server's door, holding a guest list. AWS calls it a virtual firewall (a filter for network traffic).
Inbound = traffic coming in (visitors). Outbound = traffic going out (you going to the shop).
Each rule says protocol (how they talk), port (which door number) and source (who may come).
Only allow rules exist. Not on the list = dropped. A new group lets nobody in and lets everything out.
It is stateful: replies to your own requests come back in, with no inbound rule needed.

0:00 / 3:06

Video file: test_companion/videos/aws-security-groups-excalidraw.mp4 (1920×1080, voice + subtitles).

The ideas

01The picture, part by part

Every AWS word maps to one thing in a housing society from AWS docs

AWS word	In the picture	What it really is
`VPC`	Gated society	Your own private network inside AWS.
Subnet	A building	A part of the VPC (a range of IP addresses).
`EC2` instance	Your flat	Your server.
Security group	Guard at the flat door	Filter on the server: decides which traffic may reach it and leave it.
Inbound rule	Guest list for visitors	Which traffic may come in.
Outbound rule	Where you may go	Which traffic may go out.
Network ACL	Guard at the society's main gate	A second filter for the whole subnet.

Source: AWS docs, vpc-security-groups.html, infrastructure-security.html

02What a rule is

One rule = one line on the guest list from AWS docs

Protocol	Port	Source	Means
`TCP`	`80`	`0.0.0.0/0`	Web visits from anyone on the internet.
`TCP`	`22`	`203.0.113.0/24`	Remote login (SSH) only from one address range, like your office.
`TCP`	`80`, `443`	`lb-sg`	Only machines in the load balancer's security group (the "badge" idea).

Fact	Answer
Can a rule say "deny"?	No. Only allow rules. Not on the list = dropped.
New group: inbound?	Nobody can come in (no inbound rules).
New group: outbound?	Everything may go out (one allow-all rule).
Many groups on one server?	All their rules are joined into one list. Any match lets traffic in.

Source: AWS docs, security-group-rules.html ("Security group rule basics", "Components", "Security group referencing")

03Stateful: the guard remembers

Replies to your own requests get back in from AWS docs

In everyday words

You order a pizza. The delivery person is not on your guest list, but the guard saw you place the order, so they let the pizza in.

AWS docs: if you send a request from an instance, the response traffic for that request is allowed back in whatever the inbound rules say. Replies to allowed inbound traffic may also leave, whatever the outbound rules say.

Source: AWS docs, vpc-security-groups.html ("Security group basics")

04Security group vs network ACL

Two guards, two doors from AWS docs

Point	Security group (flat door)	Network ACL (main gate)
Guards	One server (instance level)	The whole subnet
Rule types	Allow only	Allow and deny
How it checks	Looks at all rules, then decides	In number order; first match wins
Replies	Auto-allowed (stateful)	Need their own rule (stateless)

Source: AWS docs, infrastructure-security.html ("Compare security groups and network ACLs")

Reference

—Sources

What	Where
Security group basics, stateful	docs.aws.amazon.com/vpc/latest/userguide/vpc-security-groups.html
Rules: allow only, defaults, parts, referencing	docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html
Security group vs network ACL	docs.aws.amazon.com/vpc/latest/userguide/infrastructure-security.html
Voice	macOS `say`, voice Samantha