Why security groups matter in AWS - Why It Works

Introduction

Security groups act like virtual firewalls for your cloud servers. They control who can talk to your servers and what kind of traffic is allowed. This helps keep your servers safe from unwanted access.

When you want to allow your web server to accept traffic only on port 80 and 443 from the internet.

When you need to restrict database access so only your application servers can connect to it.

When you want to block all traffic except from specific IP addresses for extra security.

When you want to quickly change access rules without touching the server itself.

When you want to separate different parts of your system with different access rules.

Commands

This command creates a new security group named 'my-web-sg' in the specified VPC. It acts as a firewall container for your web servers.

Terminal

aws ec2 create-security-group --group-name my-web-sg --description "Security group for web servers" --vpc-id vpc-0abc123def456ghij

Expected Output

{

    "GroupId": "sg-0123456789abcdef0"

}

→

--group-name - Sets the name of the security group.

→

--description - Provides a description to identify the security group.

→

--vpc-id - Specifies the VPC where the security group will be created.

This command allows incoming HTTP traffic on port 80 from anywhere to the security group, enabling web access.

Terminal

aws ec2 authorize-security-group-ingress --group-id sg-0123456789abcdef0 --protocol tcp --port 80 --cidr 0.0.0.0/0

Expected Output

No output (command runs silently)

→

--group-id - Specifies which security group to update.

→

--protocol - Defines the protocol to allow (tcp in this case).

→

--port - Sets the port number to allow traffic on.

→

--cidr - Defines the IP range allowed to access.

This command shows the current rules of the security group so you can verify what traffic is allowed.

Terminal

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0

Expected Output

{

    "SecurityGroups": [

        {

            "GroupId": "sg-0123456789abcdef0",

            "GroupName": "my-web-sg",

            "Description": "Security group for web servers",

            "IpPermissions": [

                {

                    "IpProtocol": "tcp",

                    "FromPort": 80,

                    "ToPort": 80,

                    "IpRanges": [

                        {

                            "CidrIp": "0.0.0.0/0"

                        }

                    ]

                }

            ]

        }

    ]

}

→

--group-ids - Specifies the security group to describe.

Key Concept

If you remember nothing else from this pattern, remember: security groups control who can reach your servers and what traffic is allowed, keeping your cloud resources safe.

Common Mistakes

Not specifying the correct VPC ID when creating a security group.

The security group will not be created or will be created in the wrong network, causing connectivity issues.

Always check and use the correct VPC ID where your resources are deployed.

Allowing all traffic (0.0.0.0/0) on sensitive ports like database ports.

This exposes your servers to the entire internet, risking unauthorized access.

Restrict access to trusted IPs or other security groups only.

Forgetting to add ingress rules after creating the security group.

Without rules, no traffic can reach your servers, causing them to be unreachable.

Always add necessary ingress rules to allow required traffic.

Summary

Create a security group to act as a firewall for your cloud servers.

Add ingress rules to allow specific traffic like HTTP on port 80.

Verify the security group rules to ensure only intended traffic is allowed.