> For the complete documentation index, see [llms.txt](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://karansingh.gitbook.io/tutorialsdojo-wrong-answers-aws-sec-spec/review-mode-test-1-93/controlling-network-traffic-to-ec2-instances.md).

# Controlling network traffic to EC2 instances

* Consider the **following options for controlling network traffic to your EC2 instances:**<br>
  * **Restrict access to your instances using security groups** - **Permit only the minimum required network traffic for the EC2 instances**.<br>
  * **Leverage security groups as the primary mechanism for controlling network access** to EC2 instances - **Security groups are more versatile than network ACLs** due to their ability to **perform stateful packet filtering and create rules that reference other security groups**.<br>
  * Use **VPC Flow Logs to monitor the traffic** that reaches your instances.<br>
  * Use **Security Hub to check for unintended network accessibility** from your instances.<br>
  * Use **Systems Manager Session Manager to access your instances remotely instead of opening inbound RDP ports**.<br>
  * Use **Systems Manager Run Command to automate common administrative tasks** instead of opening inbound RDP ports.