Bird
Raised Fist0
AWScloud~5 mins

Default security group behavior in AWS - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Introduction
When you create a new virtual network in AWS, it automatically creates a default security group. This group controls what network traffic is allowed to and from your resources. Understanding its default rules helps keep your resources safe without extra setup.
When you launch a new virtual server (EC2 instance) without specifying a security group.
When you want to quickly test connectivity between instances in the same network.
When you need a simple default firewall that allows communication inside your network but blocks outside access.
When you want to understand why your instance can talk to others by default without extra rules.
When you want to customize security but start from a known safe baseline.
Commands
This command lists the default security groups in your AWS account. It shows their IDs and rules so you can see what traffic is allowed by default.
Terminal
aws ec2 describe-security-groups --filters Name=group-name,Values=default
Expected OutputExpected
{ "SecurityGroups": [ { "Description": "default VPC security group", "GroupName": "default", "IpPermissions": [ { "IpProtocol": "-1", "UserIdGroupPairs": [ { "GroupId": "sg-0123456789abcdef0", "UserId": "123456789012" } ] } ], "IpPermissionsEgress": [ { "IpProtocol": "-1", "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ] } ], "GroupId": "sg-0123456789abcdef0", "VpcId": "vpc-0abcdef1234567890", "OwnerId": "123456789012" } ] }
→
--filters - Filters results to show only the default security group by name
This command shows detailed rules of the default security group by its ID. It helps you understand what inbound and outbound traffic is allowed.
Terminal
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0
Expected OutputExpected
{ "SecurityGroups": [ { "GroupId": "sg-0123456789abcdef0", "GroupName": "default", "Description": "default VPC security group", "IpPermissions": [ { "IpProtocol": "-1", "UserIdGroupPairs": [ { "GroupId": "sg-0123456789abcdef0", "UserId": "123456789012" } ] } ], "IpPermissionsEgress": [ { "IpProtocol": "-1", "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ] } ], "VpcId": "vpc-0abcdef1234567890", "OwnerId": "123456789012" } ] }
→
--group-ids - Specifies the security group ID to describe
This command adds a rule to the default security group to allow SSH access from anywhere. It shows how you can customize the default group to allow specific traffic.
Terminal
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 22 --cidr 0.0.0.0/0
Expected OutputExpected
No output (command runs silently)
→
--group-id - Specifies which security group to update
→
--protocol - Sets the network protocol (tcp)
→
--port - Sets the port number (22 for SSH)
→
--cidr - Defines the allowed IP range (any IP here)
Check the updated rules of the default security group to confirm the new SSH rule is added.
Terminal
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0
Expected OutputExpected
{ "SecurityGroups": [ { "GroupId": "sg-0123456789abcdef0", "GroupName": "default", "Description": "default VPC security group", "IpPermissions": [ { "IpProtocol": "-1", "UserIdGroupPairs": [ { "GroupId": "sg-0123456789abcdef0", "UserId": "123456789012" } ] }, { "IpProtocol": "tcp", "FromPort": 22, "ToPort": 22, "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ] } ], "IpPermissionsEgress": [ { "IpProtocol": "-1", "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ] } ], "VpcId": "vpc-0abcdef1234567890", "OwnerId": "123456789012" } ] }
→
--group-ids - Specifies the security group ID to describe
Key Concept

If you remember nothing else from this pattern, remember: the default security group allows all outbound traffic and inbound traffic only from resources assigned to the same group.

Common Mistakes
Assuming the default security group allows inbound traffic from any IP by default.
By default, inbound traffic is only allowed from other instances in the same security group, not from the internet.
Explicitly add inbound rules to allow traffic from outside sources if needed.
Deleting the default security group without creating a replacement.
AWS requires a default security group for each VPC; deleting it can cause errors or loss of connectivity.
Modify the default group rules instead of deleting it, or create a new security group and assign it to instances.
Summary
Use 'aws ec2 describe-security-groups' to view the default security group and its rules.
The default security group allows all outbound traffic and inbound traffic only from itself.
You can add rules to the default group to allow specific inbound traffic like SSH.

Practice

(1/5)
1. What is the default behavior of the AWS default security group for inbound traffic?
easy
A. It blocks all inbound traffic by default.
B. It allows inbound traffic from any IP address.
C. It allows inbound traffic only from resources assigned to the same security group.
D. It allows inbound traffic only on port 80.

Solution

  1. Step 1: Understand default inbound rules

    The default security group allows inbound traffic only from instances assigned to the same security group.

  2. Step 2: Compare options with default behavior

    Only It allows inbound traffic only from resources assigned to the same security group. matches: It allows inbound traffic only from resources assigned to the same security group; others allow broader or no inbound traffic.

  3. Final Answer:

    It allows inbound traffic only from resources assigned to the same security group. -> Option C

  4. Quick Check:

    Inbound traffic limited to same group = A [OK]
Hint: Default inbound allows traffic only from same security group [OK]
Common Mistakes:
  • Thinking default allows inbound from anywhere
  • Assuming default blocks all inbound traffic
  • Believing default allows inbound only on specific ports
2. Which of the following is a correct statement about the AWS default security group syntax when creating a new rule?
easy
A. The default security group automatically allows all outbound traffic.
B. You must specify a CIDR block for inbound rules.
C. You cannot add any rules to the default security group.
D. The default security group blocks all outbound traffic by default.

Solution

  1. Step 1: Review default outbound behavior

    The default security group allows all outbound traffic by default without needing extra rules.

  2. Step 2: Evaluate each option

    The default security group automatically allows all outbound traffic. correctly states the default outbound allowance; others are incorrect about rules or blocking.

  3. Final Answer:

    The default security group automatically allows all outbound traffic. -> Option A

  4. Quick Check:

    Default outbound = all allowed [OK]
Hint: Default security group allows all outbound traffic by default [OK]
Common Mistakes:
  • Assuming outbound rules must be manually added
  • Believing default security group blocks outbound traffic
  • Thinking CIDR block is mandatory for all rules
3. Given an EC2 instance assigned to the default security group, which of the following inbound traffic scenarios will be allowed?
medium
A. Inbound traffic from an EC2 instance in a different security group.
B. Inbound traffic from another EC2 instance assigned to the default security group.
C. Inbound traffic from the same EC2 instance itself.
D. Inbound traffic from any IP address on port 22.

Solution

  1. Step 1: Recall default inbound rule

    The default security group allows inbound traffic only from instances assigned to the same security group.

  2. Step 2: Analyze each option

    Inbound traffic from another EC2 instance assigned to the default security group matches this rule; A is different group, B is self (not inbound from self), D is open to all IPs which is not allowed.

  3. Final Answer:

    Inbound traffic from another EC2 instance assigned to the default security group. -> Option B

  4. Quick Check:

    Inbound allowed only from same group instances = C [OK]
Hint: Inbound allowed only from instances in same security group [OK]
Common Mistakes:
  • Assuming inbound allowed from any IP
  • Confusing inbound from self as allowed
  • Thinking different security groups allow inbound by default
4. You tried to delete the default security group in your VPC but received an error. What is the most likely reason?
medium
A. Default security groups cannot be deleted.
B. You need to detach all instances before deleting.
C. You must disable all inbound rules first.
D. You need to delete the VPC first.

Solution

  1. Step 1: Understand default security group restrictions

    The default security group cannot be deleted by design in AWS.

  2. Step 2: Evaluate other options

    Detaching instances or disabling rules is not sufficient; deleting VPC is unrelated to this error.

  3. Final Answer:

    Default security groups cannot be deleted. -> Option A

  4. Quick Check:

    Default security group deletion blocked = D [OK]
Hint: Default security group cannot be deleted [OK]
Common Mistakes:
  • Trying to delete without detaching instances
  • Thinking disabling rules allows deletion
  • Assuming VPC must be deleted first
5. You want to restrict outbound traffic from an EC2 instance assigned to the default security group. What must you do?
hard
A. Modify the default security group outbound rules to restrict traffic.
B. Outbound traffic cannot be restricted for instances in the default security group.
C. Delete the default security group and create a custom one with restrictions.
D. Create a new security group with restricted outbound rules and assign it to the instance.

Solution

  1. Step 1: Understand default security group modification limits

    You can modify rules but cannot delete the default security group; modifying outbound rules is possible but affects all instances assigned.

  2. Step 2: Best practice for restricting outbound traffic

    Creating a new security group with specific outbound restrictions and assigning it to the instance is the recommended approach.

  3. Final Answer:

    Create a new security group with restricted outbound rules and assign it to the instance. -> Option D

  4. Quick Check:

    Use new security group to restrict outbound traffic = B [OK]
Hint: Use a new security group to restrict outbound traffic [OK]
Common Mistakes:
  • Trying to delete the default security group
  • Modifying default group outbound rules affecting all instances
  • Assuming outbound restrictions are impossible