Why security groups matter in AWS - Why It Works

Introduction

Security groups act like virtual firewalls for your cloud servers. They control who can talk to your servers and what kind of traffic is allowed. This helps keep your servers safe from unwanted access.

When you want to allow your web server to accept traffic only on port 80 and 443 from the internet.

When you need to restrict database access so only your application servers can connect to it.

When you want to block all traffic except from specific IP addresses for extra security.

When you want to quickly change access rules without touching the server itself.

When you want to separate different parts of your system with different access rules.

Commands

This command creates a new security group named 'my-web-sg' in the specified VPC. It acts as a firewall container for your web servers.

Terminal

aws ec2 create-security-group --group-name my-web-sg --description "Security group for web servers" --vpc-id vpc-0abc123def456ghij

Expected Output

{

    "GroupId": "sg-0123456789abcdef0"

}

→

--group-name - Sets the name of the security group.

→

--description - Provides a description to identify the security group.

→

--vpc-id - Specifies the VPC where the security group will be created.

This command allows incoming HTTP traffic on port 80 from anywhere to the security group, enabling web access.

Terminal

aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 80 --cidr 0.0.0.0/0

Expected Output

No output (command runs silently)

→

--group-id - Specifies which security group to update.

→

--protocol - Defines the protocol to allow (tcp in this case).

→

--port - Sets the port number to allow traffic on.

→

--cidr - Defines the IP range allowed to access.

This command shows the current rules of the security group so you can verify what traffic is allowed.

Terminal

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

Expected Output

{

    "SecurityGroups": [

        {

            "GroupId": "sg-0123456789abcdef0",

            "GroupName": "my-web-sg",

            "Description": "Security group for web servers",

            "IpPermissions": [

                {

                    "IpProtocol": "tcp",

                    "FromPort": 80,

                    "ToPort": 80,

                    "IpRanges": [

                        {

                            "CidrIp": "0.0.0.0/0"

                        }

                    ]

                }

            ]

        }

    ]

}

→

--group-ids - Specifies the security group to describe.

Key Concept

If you remember nothing else from this pattern, remember: security groups control who can reach your servers and what traffic is allowed, keeping your cloud resources safe.

Common Mistakes

Not specifying the correct VPC ID when creating a security group.

The security group will not be created or will be created in the wrong network, causing connectivity issues.

Always check and use the correct VPC ID where your resources are deployed.

Allowing all traffic (0.0.0.0/0) on sensitive ports like database ports.

This exposes your servers to the entire internet, risking unauthorized access.

Restrict access to trusted IPs or other security groups only.

Forgetting to add ingress rules after creating the security group.

Without rules, no traffic can reach your servers, causing them to be unreachable.

Always add necessary ingress rules to allow required traffic.

Summary

Create a security group to act as a firewall for your cloud servers.

Add ingress rules to allow specific traffic like HTTP on port 80.

Verify the security group rules to ensure only intended traffic is allowed.

Practice

1. What is the main purpose of a security group in AWS?

easy

A. To control inbound and outbound network traffic to resources

B. To store data securely in the cloud

C. To manage user permissions for AWS services

D. To monitor the health of AWS resources

Solution

1. Step 1: Understand what security groups do

   Security groups act like virtual firewalls that control network traffic to and from AWS resources.

2. Step 2: Identify the main function

   The main function is to allow or block inbound and outbound traffic based on rules.

3. Final Answer:

   To control inbound and outbound network traffic to resources -> Option A

4. Quick Check:

   Security groups control traffic = A [OK]

Hint: Security groups control traffic flow to resources [OK]

Common Mistakes:

• Confusing security groups with data storage
• Thinking security groups manage user permissions
• Assuming security groups monitor resource health

2. Which of the following is the correct way to allow HTTP traffic on port 80 in a security group rule?

easy

A. Allow inbound TCP traffic on port 80

B. Allow outbound UDP traffic on port 80

C. Allow inbound TCP traffic on port 22

D. Allow inbound ICMP traffic on port 80

Solution

1. Step 1: Identify the protocol and port for HTTP

   HTTP uses TCP protocol on port 80.

2. Step 2: Match the correct rule

   Allowing inbound TCP traffic on port 80 correctly allows HTTP requests.

3. Final Answer:

   Allow inbound TCP traffic on port 80 -> Option A

4. Quick Check:

   HTTP = TCP port 80 inbound [OK]

Hint: HTTP uses TCP port 80 inbound [OK]

Common Mistakes:

• Allowing wrong protocol like UDP or ICMP for HTTP
• Allowing outbound instead of inbound traffic
• Using wrong port number like 22 (SSH)

3. Given a security group with these inbound rules:
- Allow TCP port 22 from 0.0.0.0/0
- Allow TCP port 80 from 192.168.1.0/24
Which IP address can access port 80?

medium

A. 10.0.0.5

B. 0.0.0.0

C. 192.168.1.15

D. 172.16.0.1

Solution

1. Step 1: Understand the CIDR block for port 80

   The rule allows TCP port 80 only from IPs in 192.168.1.0/24 range, which means 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP fits the range

   192.168.1.15 is inside the allowed range, others are not.

3. Final Answer:

   192.168.1.15 -> Option C

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.15 [OK]

Hint: Check if IP fits CIDR range for allowed port [OK]

Common Mistakes:

• Confusing 0.0.0.0/0 with specific ranges
• Assuming all IPs can access port 80
• Mixing up port 22 and port 80 rules

4. You created a security group rule to allow inbound SSH (port 22) from your office IP, but you still cannot connect. What is the most likely mistake?

medium

A. The rule allows outbound traffic instead of inbound

B. The office IP is not in the allowed CIDR range

C. The rule uses UDP instead of TCP for port 22

D. The security group is attached to the wrong resource

Solution

1. Step 1: Check rule direction and protocol

   Inbound SSH requires TCP on port 22 inbound; if rule is correct, this is fine.

2. Step 2: Verify security group attachment

   If the security group is not attached to the resource (like EC2 instance), rules won't apply.

3. Final Answer:

   The security group is attached to the wrong resource -> Option D

4. Quick Check:

   Security group must be attached to resource [OK]

Hint: Check if security group is attached to your resource [OK]

Common Mistakes:

• Ignoring security group attachment
• Confusing inbound and outbound rules
• Using wrong protocol for SSH

5. You want to secure a web server so only your company's office IP range (203.0.113.0/24) can access HTTP (port 80), but allow SSH (port 22) from anywhere for remote admins. Which security group rules should you create?

hard

A. Allow inbound TCP port 80 from 0.0.0.0/0 and inbound TCP port 22 from 203.0.113.0/24

B. Allow inbound TCP port 80 from 203.0.113.0/24 and inbound TCP port 22 from 0.0.0.0/0

C. Allow inbound TCP port 80 and 22 both from 203.0.113.0/24 only

D. Allow inbound TCP port 80 and 22 both from 0.0.0.0/0 only

Solution

1. Step 1: Match HTTP access to office IP range

   HTTP (port 80) should be allowed only from 203.0.113.0/24 to restrict access to office IPs.

2. Step 2: Allow SSH from anywhere

   SSH (port 22) should be open to 0.0.0.0/0 to allow remote admins from any IP.

3. Final Answer:

   Allow inbound TCP port 80 from 203.0.113.0/24 and inbound TCP port 22 from 0.0.0.0/0 -> Option B

4. Quick Check:

   HTTP restricted, SSH open = A [OK]

Hint: Restrict HTTP, open SSH from anywhere [OK]

Common Mistakes:

• Reversing IP ranges for ports
• Opening HTTP to all IPs
• Restricting SSH too much