Bird
Raised Fist0
AWScloud~5 mins

Inbound and outbound rules in AWS - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Introduction
When you run servers or applications in the cloud, you need to control who can talk to them and who they can talk to. Inbound and outbound rules let you decide what traffic is allowed in and out of your cloud resources to keep them safe.
When you want to allow users to access your web server on port 80 but block other ports.
When your application needs to connect to a database on a specific port.
When you want to block all incoming traffic except from trusted IP addresses.
When your server needs to send data out to the internet but should not accept any incoming connections.
When you want to open SSH access only from your office IP to manage your server securely.
Commands
This command creates a new security group named 'my-security-group' in the specified VPC. Security groups act like virtual firewalls controlling inbound and outbound traffic.
Terminal
aws ec2 create-security-group --group-name my-security-group --description "My security group for web server" --vpc-id vpc-0abcd1234efgh5678
Expected OutputExpected
{ "GroupId": "sg-0123456789abcdef0" }
→
--group-name - Sets the name of the security group.
→
--description - Describes the purpose of the security group.
→
--vpc-id - Specifies the VPC where the security group will be created.
This command adds an inbound rule to allow HTTP traffic on port 80 from any IP address to the security group.
Terminal
aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 80 --cidr 0.0.0.0/0
Expected OutputExpected
No output (command runs silently)
→
--group-id - Specifies which security group to update.
→
--protocol - Defines the protocol to allow (tcp in this case).
→
--port - Sets the port number to allow traffic on.
→
--cidr - Defines the IP range allowed to connect.
This command adds an outbound rule to allow HTTPS traffic on port 443 to any IP address from the security group.
Terminal
aws ec2 authorize-security-group-egress --group-id sg-0123456789abcdef0 --protocol tcp --port 443 --cidr 0.0.0.0/0
Expected OutputExpected
No output (command runs silently)
→
--group-id - Specifies which security group to update.
→
--protocol - Defines the protocol to allow.
→
--port - Sets the port number for outbound traffic.
→
--cidr - Defines the IP range allowed for outbound connections.
This command shows the current inbound and outbound rules for the specified security group so you can verify your settings.
Terminal
aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0
Expected OutputExpected
{ "SecurityGroups": [ { "GroupId": "sg-0123456789abcdef0", "GroupName": "my-security-group", "IpPermissions": [ { "IpProtocol": "tcp", "FromPort": 80, "ToPort": 80, "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ] } ], "IpPermissionsEgress": [ { "IpProtocol": "tcp", "FromPort": 443, "ToPort": 443, "IpRanges": [ { "CidrIp": "0.0.0.0/0" } ] } ] } ] }
→
--group-ids - Specifies which security group to describe.
Key Concept

If you remember nothing else from this pattern, remember: inbound rules control who can connect to your resources, and outbound rules control where your resources can connect to.

Common Mistakes
Not specifying the correct security group ID when adding rules.
The rules will be added to the wrong security group or the command will fail.
Always double-check the security group ID before running authorize commands.
Allowing inbound traffic from 0.0.0.0/0 on sensitive ports like SSH (22) without restrictions.
This exposes your server to the entire internet and increases security risks.
Limit inbound access to trusted IP addresses or ranges for sensitive ports.
Forgetting to add outbound rules when your application needs to connect to external services.
Your server may not be able to send data out, causing failures.
Add outbound rules that allow necessary traffic to external IPs and ports.
Summary
Create a security group to act as a virtual firewall for your cloud resources.
Add inbound rules to allow specific incoming traffic like HTTP or SSH.
Add outbound rules to allow your resources to send traffic out to the internet or other services.
Verify your rules using the describe-security-groups command to ensure correct configuration.

Practice

(1/5)
1. What do inbound rules in a security group control in AWS?
easy
A. Both incoming and outgoing traffic
B. Outgoing traffic from your resources
C. Incoming traffic to your resources
D. Traffic between AWS regions

Solution

  1. Step 1: Understand inbound rules purpose

    Inbound rules specify what incoming network traffic is allowed to reach your AWS resources.

  2. Step 2: Differentiate inbound from outbound

    Outbound rules control outgoing traffic, so inbound rules only affect incoming connections.

  3. Final Answer:

    Incoming traffic to your resources -> Option C

  4. Quick Check:

    Inbound = Incoming traffic [OK]
Hint: Inbound means incoming traffic allowed [OK]
Common Mistakes:
  • Confusing inbound with outbound rules
  • Thinking inbound controls outgoing traffic
  • Assuming inbound controls both directions
2. Which of the following is the correct way to allow HTTP traffic inbound on port 80 in an AWS security group?
easy
A. Allow TCP traffic on port 80 inbound
B. Allow TCP traffic on port 22 inbound
C. Allow UDP traffic on port 80 outbound
D. Allow ICMP traffic inbound

Solution

  1. Step 1: Identify HTTP port and protocol

    HTTP uses TCP protocol on port 80.

  2. Step 2: Match rule to allow inbound HTTP

    Allowing TCP traffic on port 80 inbound correctly permits HTTP requests.

  3. Final Answer:

    Allow TCP traffic on port 80 inbound -> Option A

  4. Quick Check:

    HTTP = TCP port 80 inbound [OK]
Hint: HTTP uses TCP port 80 inbound [OK]
Common Mistakes:
  • Using wrong port number for HTTP
  • Allowing outbound instead of inbound
  • Using UDP instead of TCP for HTTP
3. Given this security group outbound rule: Allow all traffic (all protocols) to 0.0.0.0/0, what is the effect?
medium
A. Allows outbound traffic only on port 443
B. Blocks all outbound traffic
C. Allows inbound traffic from any IP
D. Allows all outbound traffic to any IP

Solution

  1. Step 1: Analyze the outbound rule details

    The rule allows all protocols and all ports outbound to any IP address (0.0.0.0/0 means anywhere).

  2. Step 2: Understand outbound traffic effect

    This means any outbound traffic from the resource is allowed to any destination.

  3. Final Answer:

    Allows all outbound traffic to any IP -> Option D

  4. Quick Check:

    Outbound all traffic to 0.0.0.0/0 = Allow all outbound [OK]
Hint: 0.0.0.0/0 means anywhere, all protocols means all traffic [OK]
Common Mistakes:
  • Confusing inbound and outbound rules
  • Thinking it blocks traffic
  • Assuming it restricts ports
4. You created an inbound rule allowing TCP port 22 from 0.0.0.0/0 but cannot SSH into your EC2 instance. What is a likely cause?
medium
A. Security group is not attached to the instance
B. Inbound rule uses UDP instead of TCP
C. Port 22 is closed on the instance's OS firewall
D. Outbound rules block all traffic

Solution

  1. Step 1: Check security group attachment

    Even if rules are correct, if the security group is not attached to the instance, rules won't apply.

  2. Step 2: Consider other causes

    Outbound rules usually allow return traffic by default; OS firewall or protocol mismatch would cause different symptoms.

  3. Final Answer:

    Security group is not attached to the instance -> Option A

  4. Quick Check:

    Security group must be attached to instance [OK]
Hint: Check if security group is attached to instance [OK]
Common Mistakes:
  • Ignoring security group attachment
  • Assuming outbound rules block SSH
  • Not checking OS firewall settings
5. You want to allow your web server to receive HTTP requests from anywhere but restrict outbound traffic to only HTTPS (port 443). Which inbound and outbound rules should you configure?
hard
A. Inbound: Allow UDP port 80 from 0.0.0.0/0; Outbound: Allow TCP port 443 to 0.0.0.0/0
B. Inbound: Allow TCP port 80 from 0.0.0.0/0; Outbound: Allow TCP port 443 to 0.0.0.0/0
C. Inbound: Allow TCP port 443 from 0.0.0.0/0; Outbound: Allow TCP port 80 to 0.0.0.0/0
D. Inbound: Allow TCP port 80 from 192.168.0.0/24; Outbound: Allow all traffic to 0.0.0.0/0

Solution

  1. Step 1: Set inbound rule for HTTP

    Allow TCP port 80 inbound from anywhere (0.0.0.0/0) to receive HTTP requests.

  2. Step 2: Set outbound rule for HTTPS only

    Allow TCP port 443 outbound to anywhere to restrict outgoing traffic to HTTPS.

  3. Final Answer:

    Inbound: Allow TCP port 80 from 0.0.0.0/0; Outbound: Allow TCP port 443 to 0.0.0.0/0 -> Option B

  4. Quick Check:

    Inbound HTTP, outbound HTTPS only [OK]
Hint: Inbound HTTP port 80, outbound HTTPS port 443 [OK]
Common Mistakes:
  • Mixing up inbound and outbound ports
  • Using UDP instead of TCP for HTTP
  • Restricting inbound to private IPs only