Security group as virtual firewall in AWS - Step-by-Step Execution

Process Flow - Security group as virtual firewall

Create Security Group

↓

Define Inbound Rules

↓

Define Outbound Rules

↓

Attach Security Group to Instance

↓

Traffic Arrives at Instance

↓

Check Inbound Rules

↓

Allow Traffic

This flow shows how a security group is created, rules are set, attached to an instance, and then how incoming traffic is checked against rules to allow or block it.

Execution Sample

AWS

Create SG "web-sg"
Add inbound rule: TCP 80 from 0.0.0.0/0
Add outbound rule: All traffic allowed
Attach SG to EC2 instance
Incoming TCP 80 request arrives

This example creates a security group allowing web traffic on port 80, attaches it to an instance, and processes an incoming web request.

Process Table

Step	Action	Rule Checked	Traffic Port	Source IP	Result
1	Create security group 'web-sg'	N/A	N/A	N/A	SG created with no rules
2	Add inbound rule TCP 80 from 0.0.0.0/0	Inbound	80	0.0.0.0/0	Rule added
3	Add outbound rule all traffic allowed	Outbound	All	All	Rule added
4	Attach SG to EC2 instance	N/A	N/A	N/A	SG attached
5	Incoming TCP 80 request from 203.0.113.5	Inbound	80	203.0.113.5	Allowed (matches rule)
6	Incoming TCP 22 request from 203.0.113.5	Inbound	22	203.0.113.5	Denied (no matching rule)

💡 Traffic denied if no inbound rule matches; allowed only if rules explicitly permit.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6
Security Group Rules	{}	{"Inbound": [{"Protocol": "TCP", "Port": 80, "Source": "0.0.0.0/0"}]}	{"Inbound": [{"Protocol": "TCP", "Port": 80, "Source": "0.0.0.0/0"}], "Outbound": [{"Protocol": "All", "Port": "All", "Destination": "All"}]}	Attached to instance	No change	No change
Incoming Traffic	None	None	None	None	{"Port": 80, "Source": "203.0.113.5"}	{"Port": 22, "Source": "203.0.113.5"}
Traffic Allowed?	N/A	N/A	N/A	N/A	Yes	No

Key Moments - 2 Insights

Why is the TCP 22 request denied even though the security group allows all outbound traffic?

Inbound and outbound rules are checked separately. The TCP 22 request is inbound and no inbound rule allows port 22, so it is denied as shown in step 6 of the execution_table.

Does the security group block traffic by default if no rule matches?

Yes, security groups are deny-by-default. Only traffic explicitly allowed by inbound or outbound rules passes, as seen in step 6 where port 22 is denied.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result for incoming TCP 80 traffic at step 5?

A Denied because no outbound rule matches

B Denied because source IP is blocked

C Allowed because it matches an inbound rule

D Allowed because all traffic is allowed by default

💡 Hint

Check row 5 in execution_table under 'Result' column

At which step is the security group attached to the EC2 instance?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look for the action 'Attach SG to EC2 instance' in execution_table

If we add an inbound rule allowing TCP 22 from 0.0.0.0/0, how would the result at step 6 change?

A It would still be denied

B It would be allowed

C It would be blocked by outbound rules

D It would cause an error

💡 Hint

Refer to variable_tracker and execution_table step 6 about rule matching

Concept Snapshot

Security groups act like virtual firewalls controlling inbound and outbound traffic.
Rules specify allowed protocols, ports, and sources/destinations.
Traffic not matching rules is blocked by default.
Attach security groups to instances to enforce rules.
Inbound and outbound rules are checked separately.

Full Transcript

This visual execution shows how a security group is created and configured with inbound and outbound rules. The security group is then attached to an EC2 instance. Incoming traffic is checked against inbound rules to decide if it is allowed or denied. Traffic on TCP port 80 from any IP is allowed because of the inbound rule. Traffic on TCP port 22 is denied because no inbound rule allows it. Outbound rules do not affect inbound traffic. Security groups block all traffic by default unless explicitly allowed.