Why security groups matter in AWS - Visual Breakdown

Process Flow - Why security groups matter

Create Security Group

↓

Define Rules: Allow or Deny Traffic

↓

Attach Security Group to Resource

↓

Traffic Arrives

↓

Check Traffic Against Rules

↓

Resource Access

Security groups act like virtual firewalls. They control which traffic can reach your cloud resources by allowing or blocking connections based on rules.

Execution Sample

AWS

Create SG with rule: Allow TCP port 22 from 0.0.0.0/0
Attach SG to EC2 instance
Incoming traffic on port 22 arrives
Check if allowed by SG
Allow or deny access

This example shows how a security group controls SSH access to an EC2 instance by allowing or blocking incoming traffic on port 22.

Process Table

Step	Action	Traffic Port	Source IP	Rule Check Result	Access Outcome
1	Create SG with rule	22	0.0.0.0/0	Rule allows port 22 from anywhere	N/A
2	Attach SG to EC2	N/A	N/A	SG linked to instance	N/A
3	Incoming traffic arrives	22	203.0.113.5	Matches allow rule	Access Allowed
4	Incoming traffic arrives	80	203.0.113.5	No matching allow rule	Access Denied
5	Incoming traffic arrives	22	10.0.0.1	Matches allow rule	Access Allowed
6	Incoming traffic arrives	22	192.168.1.1	Matches allow rule	Access Allowed
7	Incoming traffic arrives	443	0.0.0.0/0	No matching allow rule	Access Denied
8	End of traffic checks	N/A	N/A	No more traffic	N/A

💡 Traffic is allowed only if it matches a security group rule; otherwise, it is denied by default.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	After Step 5	After Step 6	After Step 7	Final
Security Group Rules	Empty	Allow TCP 22 from 0.0.0.0/0	Attached to EC2	Checked port 22 from 203.0.113.5	Checked port 80 from 203.0.113.5	Checked port 22 from 10.0.0.1	Checked port 22 from 192.168.1.1	Checked port 443 from 0.0.0.0/0	Rules unchanged
Access Outcome	N/A	N/A	N/A	Allowed	Denied	Allowed	Allowed	Denied	N/A

Key Moments - 3 Insights

Why does traffic on port 80 get denied even though the security group allows port 22?

Because the security group only has a rule allowing port 22. Traffic on port 80 does not match any allow rule, so it is denied by default as shown in step 4 of the execution table.

If a security group rule allows traffic from 0.0.0.0/0, does it mean all IPs can access the resource?

Yes, 0.0.0.0/0 means any IP address. So any incoming traffic on the allowed port from any IP is permitted, as seen in steps 3, 5, and 6.

What happens if no security group is attached to a resource?

Without a security group, the resource has no rules to allow traffic, so all incoming traffic is denied by default.

Visual Quiz - 3 Questions

Look at the execution table, what is the access outcome for traffic on port 22 from IP 203.0.113.5?

A Rule Not Found

B Access Allowed

C Access Denied

D Access Pending

💡 Hint

Check step 3 in the execution table where port 22 from 203.0.113.5 is evaluated.

At which step does traffic get denied because no matching allow rule exists?

A Step 5

B Step 3

C Step 4

D Step 6

💡 Hint

Look for the step where port 80 traffic is checked and denied.

If the security group rule changed to allow TCP port 80 from 0.0.0.0/0, what would happen at step 4?

A Access would be allowed

B Access would be denied

C No change in access

D Traffic would be blocked

💡 Hint

Refer to the rule check results in the execution table and imagine the rule includes port 80.

Concept Snapshot

Security groups control network traffic to cloud resources.
They act like firewalls with rules to allow or deny traffic.
Rules specify allowed ports, protocols, and source IPs.
Traffic not matching any rule is denied by default.
Attach security groups to resources to enforce access control.

Full Transcript

Security groups are virtual firewalls in AWS that control which network traffic can reach your cloud resources. You create a security group and define rules that allow specific traffic, such as TCP port 22 for SSH from any IP address. Then you attach this security group to a resource like an EC2 instance. When traffic arrives, AWS checks it against the security group rules. If the traffic matches an allow rule, it is permitted; otherwise, it is blocked by default. For example, traffic on port 22 from any IP is allowed, but traffic on port 80 is denied if no rule allows it. This mechanism protects your resources by controlling access precisely.

Practice

1. What is the main purpose of a security group in AWS?

easy

A. To control inbound and outbound network traffic to resources

B. To store data securely in the cloud

C. To manage user permissions for AWS services

D. To monitor the health of AWS resources

Solution

1. Step 1: Understand what security groups do

   Security groups act like virtual firewalls that control network traffic to and from AWS resources.

2. Step 2: Identify the main function

   The main function is to allow or block inbound and outbound traffic based on rules.

3. Final Answer:

   To control inbound and outbound network traffic to resources -> Option A

4. Quick Check:

   Security groups control traffic = A [OK]

Hint: Security groups control traffic flow to resources [OK]

Common Mistakes:

• Confusing security groups with data storage
• Thinking security groups manage user permissions
• Assuming security groups monitor resource health

2. Which of the following is the correct way to allow HTTP traffic on port 80 in a security group rule?

easy

A. Allow inbound TCP traffic on port 80

B. Allow outbound UDP traffic on port 80

C. Allow inbound TCP traffic on port 22

D. Allow inbound ICMP traffic on port 80

Solution

1. Step 1: Identify the protocol and port for HTTP

   HTTP uses TCP protocol on port 80.

2. Step 2: Match the correct rule

   Allowing inbound TCP traffic on port 80 correctly allows HTTP requests.

3. Final Answer:

   Allow inbound TCP traffic on port 80 -> Option A

4. Quick Check:

   HTTP = TCP port 80 inbound [OK]

Hint: HTTP uses TCP port 80 inbound [OK]

Common Mistakes:

• Allowing wrong protocol like UDP or ICMP for HTTP
• Allowing outbound instead of inbound traffic
• Using wrong port number like 22 (SSH)

3. Given a security group with these inbound rules:
- Allow TCP port 22 from 0.0.0.0/0
- Allow TCP port 80 from 192.168.1.0/24
Which IP address can access port 80?

medium

A. 10.0.0.5

B. 0.0.0.0

C. 192.168.1.15

D. 172.16.0.1

Solution

1. Step 1: Understand the CIDR block for port 80

   The rule allows TCP port 80 only from IPs in 192.168.1.0/24 range, which means 192.168.1.0 to 192.168.1.255.

2. Step 2: Check which IP fits the range

   192.168.1.15 is inside the allowed range, others are not.

3. Final Answer:

   192.168.1.15 -> Option C

4. Quick Check:

   192.168.1.0/24 includes 192.168.1.15 [OK]

Hint: Check if IP fits CIDR range for allowed port [OK]

Common Mistakes:

• Confusing 0.0.0.0/0 with specific ranges
• Assuming all IPs can access port 80
• Mixing up port 22 and port 80 rules

4. You created a security group rule to allow inbound SSH (port 22) from your office IP, but you still cannot connect. What is the most likely mistake?

medium

A. The rule allows outbound traffic instead of inbound

B. The office IP is not in the allowed CIDR range

C. The rule uses UDP instead of TCP for port 22

D. The security group is attached to the wrong resource

Solution

1. Step 1: Check rule direction and protocol

   Inbound SSH requires TCP on port 22 inbound; if rule is correct, this is fine.

2. Step 2: Verify security group attachment

   If the security group is not attached to the resource (like EC2 instance), rules won't apply.

3. Final Answer:

   The security group is attached to the wrong resource -> Option D

4. Quick Check:

   Security group must be attached to resource [OK]

Hint: Check if security group is attached to your resource [OK]

Common Mistakes:

• Ignoring security group attachment
• Confusing inbound and outbound rules
• Using wrong protocol for SSH

5. You want to secure a web server so only your company's office IP range (203.0.113.0/24) can access HTTP (port 80), but allow SSH (port 22) from anywhere for remote admins. Which security group rules should you create?

hard

A. Allow inbound TCP port 80 from 0.0.0.0/0 and inbound TCP port 22 from 203.0.113.0/24

B. Allow inbound TCP port 80 from 203.0.113.0/24 and inbound TCP port 22 from 0.0.0.0/0

C. Allow inbound TCP port 80 and 22 both from 203.0.113.0/24 only

D. Allow inbound TCP port 80 and 22 both from 0.0.0.0/0 only

Solution

1. Step 1: Match HTTP access to office IP range

   HTTP (port 80) should be allowed only from 203.0.113.0/24 to restrict access to office IPs.

2. Step 2: Allow SSH from anywhere

   SSH (port 22) should be open to 0.0.0.0/0 to allow remote admins from any IP.

3. Final Answer:

   Allow inbound TCP port 80 from 203.0.113.0/24 and inbound TCP port 22 from 0.0.0.0/0 -> Option B

4. Quick Check:

   HTTP restricted, SSH open = A [OK]

Hint: Restrict HTTP, open SSH from anywhere [OK]

Common Mistakes:

• Reversing IP ranges for ports
• Opening HTTP to all IPs
• Restricting SSH too much