Security Groups

• Acts as a "virtual firewall" for your EC2 instances to control incoming and outgoing traffic (traffic going into your instance and traffic going out of your instance).

• If you don't specify a security group, EC2 uses the default security group.

• Can only add allow rules to security groups.

  • Can't add deny rules.

• You can modify the rules for a security group at any time.

• Stateful

  • Regardless of any rules, return traffic is automatically always allowed.

Parameters for creating a security group

• Name

  • The name for the security group.

• Protocol

  • The protocol to allow.

  • The most common protocols are 6 (TCP), 17 (UDP), and 1 (ICMP).

• Port range

  • For TCP, UDP, or a custom protocol, the range of ports to allow.

  • You can specify a single port number or a range of port numbers.

• ICMP type and code

  • For ICMP, the ICMP type and code.

• Source or destination

  • The source (inbound rules) or destination (outbound rules) for the traffic.

  • Specify one of these options:

    • An individual IPv4 address.

    • An individual IPv6 address.

    • A range of IPv4 addresses, in CIDR block notation.

    • A range of IPv6 addresses, in CIDR block notation.

    • A prefix list ID.

    • Another security group.