Security Groups

Security Groups are another layer of protection for the instances. They are pretty much similar to NACL. They also allow and deny the traffic. Unlike NACL, they are stateful. This means that the return traffic is allowed regardless of the inbound rule. As mentioned, NACL sits outside the subnet and evaluates the traffic before sending it in and out of the subnet, whereas Security Groups protect the traffic to flow into the instances. A Security Group sits inside the subnet, but it is not specifically assigned to one subnet. This is also a second level of firewall. Security Groups support only the allow rule, and all the rules are evaluated before allowing the traffic to flow. You get one Security Group in each region by default when you set up your AWS account, and it is associated with the default VPC. Afterwards, every time you create a new VPC, a new Security Group is created. There are a number of situations where you would prefer to create your own Security Group instead...