> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/aws-saa-c02/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/aws-saa-c02/ec2/security-groups.md).

# Security Groups

* Acts as a **"virtual firewall" for your EC2 instances** to **control incoming and outgoing traffic** (traffic going into your instance and traffic going out of your instance).<br>
* **If you don't specify a security group, EC2 uses the default security group.**<br>
* Can **only add allow rules to security groups**.
  * **Can't add deny rules**.<br>
* You can **modify the rules for a security group at any time**.<br>
* **Stateful**
  * Regardless of any rules, **return traffic is automatically always allowed.**

## Parameters for creating a security group

* **Name**

  * The name for the security grou&#x70;**.**

* **Protocol**

  * The protocol to allow.
  * The most common protocols are 6 (TCP), 17 (UDP), and 1 (ICMP).

* **Port range**

  * For TCP, UDP, or a custom protocol, the range of ports to allow.
  * You can specify a single port number or a range of port numbers.

* **ICMP type and code**
  * For ICMP, the ICMP type and code.<br>

* **Source or destination**
  * The source (inbound rules) or destination (outbound rules) for the traffic.
  * Specify one of these options:
    * An individual IPv4 address.
    * An individual IPv6 address.
    * A range of IPv4 addresses, in CIDR block notation.
    * A range of IPv6 addresses, in CIDR block notation.
    * A prefix list ID.
    * Another security group.