Stateful behavior of security groups in AWS - Mini Project: Build & Apply

Stateful behavior of security groups

📖 Scenario: You are setting up a simple cloud network for a small web application. You need to create a security group that allows incoming web traffic on port 80 and allows the server to respond to requests automatically without extra rules.

🎯 Goal: Create an AWS security group that allows inbound HTTP traffic on port 80 and demonstrates the stateful behavior by allowing outbound response traffic without explicit outbound rules.

📋 What You'll Learn

Create a security group named web-sg.

Add an inbound rule to allow TCP traffic on port 80 from anywhere (0.0.0.0/0).

Do not add any outbound rules explicitly.

Demonstrate the stateful behavior of the security group.

💡 Why This Matters

🌍 Real World

Security groups control network traffic to cloud resources. Understanding their stateful nature helps simplify firewall rules and secure applications.

💼 Career

Cloud engineers and DevOps professionals regularly configure security groups to protect applications while allowing necessary traffic.

1

Create the security group resource

Create an AWS security group resource named web_sg with the description Allow HTTP inbound and the VPC ID set to vpc-123abc.

AWS

# Your code here to create the security group resource

Hint

Use the aws_security_group resource with the exact name web_sg.

2

Add inbound rule for HTTP traffic

Inside the aws_security_group resource web_sg, add an ingress block that allows TCP traffic on port 80 from 0.0.0.0/0.

AWS

resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP inbound"
  vpc_id      = "vpc-123abc"

  # Add ingress rule here
}

Hint

Use an ingress block with from_port and to_port set to 80, protocol set to "tcp", and cidr_blocks set to ["0.0.0.0/0"].

3

Confirm no outbound rules are added

Ensure that the aws_security_group resource web_sg does not have any egress blocks defined, so it uses the default stateful outbound behavior.

AWS

resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP inbound"
  vpc_id      = "vpc-123abc"

  ingress {
    description      = "Allow HTTP"
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
  }

  # Confirm no egress block here
}

Hint

Do not add any egress block to keep default outbound rules.

4

Add a tag to identify the security group

Add a tags block inside the aws_security_group resource web_sg with the tag Environment set to Development.

AWS

resource "aws_security_group" "web_sg" {
  name        = "web-sg"
  description = "Allow HTTP inbound"
  vpc_id      = "vpc-123abc"

  ingress {
    description      = "Allow HTTP"
    from_port        = 80
    to_port          = 80
    protocol         = "tcp"
    cidr_blocks      = ["0.0.0.0/0"]
  }

  # Add tags block here
}

Hint

Use a tags block with the key Environment and value Development.

Practice

1. What does it mean when we say AWS security groups are stateful?

easy

A. Return traffic is automatically allowed, even if no outbound rule exists

B. You must create separate rules for inbound and outbound traffic

C. Security groups remember user login sessions

D. They block all traffic by default without exceptions

Solution

1. Step 1: Understand stateful behavior in security groups

   Stateful means the security group tracks connections and allows return traffic automatically.

2. Step 2: Apply this to inbound and outbound rules

   If inbound traffic is allowed, the response outbound traffic is automatically allowed without explicit outbound rules.

3. Final Answer:

   Return traffic is automatically allowed, even if no outbound rule exists -> Option A

4. Quick Check:

   Stateful = automatic return traffic allowed [OK]

Hint: Remember: inbound allows return outbound automatically [OK]

Common Mistakes:

• Thinking outbound rules must explicitly allow return traffic
• Confusing stateful with session management
• Assuming security groups block all traffic by default

2. Which of the following is the correct way to allow inbound HTTP traffic on port 80 in a security group?

easy

A. Inbound: TCP port 22 from 0.0.0.0/0

B. Outbound: TCP port 80 from 0.0.0.0/0

C. Inbound: UDP port 80 from 0.0.0.0/0

D. Inbound: TCP port 80 from 0.0.0.0/0

Solution

1. Step 1: Identify the correct protocol and port for HTTP

   HTTP uses TCP protocol on port 80.

2. Step 2: Confirm the direction and source

   Inbound rules control incoming traffic; source 0.0.0.0/0 means from anywhere.

3. Final Answer:

   Inbound: TCP port 80 from 0.0.0.0/0 -> Option D

4. Quick Check:

   HTTP inbound = TCP 80 inbound [OK]

Hint: Inbound TCP 80 for HTTP, outbound not needed [OK]

Common Mistakes:

• Using UDP instead of TCP for HTTP
• Setting outbound instead of inbound rule
• Using port 22 which is for SSH

3. If a security group allows inbound SSH (port 22) from a specific IP, what happens when the instance responds to that SSH request?

medium

A. The response is blocked unless an outbound rule allows port 22

B. The response is automatically allowed due to stateful behavior

C. The response is allowed only if a separate inbound rule exists

D. The response is blocked by default and requires a NAT gateway

Solution

1. Step 1: Recall stateful nature of security groups

   Security groups track connections and allow return traffic automatically.

2. Step 2: Apply to SSH inbound and response outbound

   Inbound SSH allowed means response outbound traffic is automatically allowed without extra rules.

3. Final Answer:

   The response is automatically allowed due to stateful behavior -> Option B

4. Quick Check:

   Inbound SSH allows automatic response outbound [OK]

Hint: Inbound allows return traffic automatically [OK]

Common Mistakes:

• Thinking outbound rules must explicitly allow return traffic
• Confusing inbound and outbound directions
• Assuming NAT gateway is needed for return traffic

4. You created a security group with only an outbound rule allowing all traffic, but no inbound rules. You cannot connect to your instance via SSH. What is the likely problem?

medium

A. Inbound SSH traffic is blocked because no inbound rule allows port 22

B. Outbound rules block SSH response traffic

C. Security groups require both inbound and outbound rules for SSH

D. The instance must have a public IP to allow SSH

Solution

1. Step 1: Analyze the security group rules

   Only outbound rules exist; no inbound rules allow SSH (port 22).

2. Step 2: Understand inbound rules control incoming connections

   Without inbound port 22 allowed, SSH connection attempts are blocked.

3. Final Answer:

   Inbound SSH traffic is blocked because no inbound rule allows port 22 -> Option A

4. Quick Check:

   No inbound port 22 = no SSH access [OK]

Hint: Inbound rules must allow SSH for connection [OK]

Common Mistakes:

• Assuming outbound rules control incoming SSH
• Thinking both inbound and outbound rules are mandatory for SSH
• Ignoring instance public IP requirement

5. You want to allow inbound HTTP traffic from anywhere and ensure your instance can respond properly. Which security group configuration achieves this with minimal rules?

hard

A. Allow inbound TCP port 80 and outbound TCP port 80 from 0.0.0.0/0

B. Allow inbound TCP port 80 from 0.0.0.0/0 and outbound all traffic

C. Allow inbound TCP port 80 from 0.0.0.0/0 only

D. Allow inbound all traffic and outbound all traffic

Solution

1. Step 1: Recall stateful behavior of security groups

   Inbound rules allow return outbound traffic automatically without explicit outbound rules.

2. Step 2: Apply minimal rule principle

   Allowing inbound TCP port 80 from anywhere is enough; no outbound rule needed for response.

3. Final Answer:

   Allow inbound TCP port 80 from 0.0.0.0/0 only -> Option C

4. Quick Check:

   Inbound HTTP alone allows response outbound [OK]

Hint: Only inbound HTTP needed; outbound auto allowed [OK]

Common Mistakes:

• Adding unnecessary outbound rules for return traffic
• Allowing all inbound traffic instead of just HTTP
• Confusing outbound rules as mandatory for responses