Glossary
Security group
A firewall attached to a network card, listing what traffic is allowed in and out.
Think of it as: A bouncer standing at one particular door, holding a guest list.
What to know for Level 0
- Security groups only have allow rules. Everything else is denied, and you can't use one to block a single address.
- Security groups are stateful: the reply to an allowed request goes back out automatically, whatever the outbound rules say.
- A rule's source can be another security group, meaning "anything wearing that group may connect". It keeps working as servers come and go and change IPs.
- Traffic a security group doesn't allow is dropped silently, so it shows up as a timeout: for example, an app that can't reach RDS on port 3306.
More detail
Security groups only allow things; there are no deny rules. They are stateful: if a request is allowed in, the reply is allowed out automatically. A rule’s source can be an IP range or another security group, which means “anything wearing that group”.
Quiz yourself on Security group →
← All terms