VPC Security—Security Groups and NACLs

When you launch an EC2 instance as a web server, it is locked down by default. The instance won’t respond to traffic unless rules are added to allow it. This is intentional: AWS attaches a Security Group, which functions as a virtual firewall around the instance.

Unlike traditional firewalls, Security Groups are stateful. If we allow inbound traffic on port 443 (HTTPS), the corresponding response traffic is automatically allowed, even if no explicit outbound rule exists. Security Groups operate at the ENI (elastic network interface) level, meaning they apply directly to EC2, Lambda (in VPC mode), RDS, and other services with network interfaces.

Here’s an ...