- Now let's talk about security groups within AWS VPC.
Now security groups are another tool
that we have access to within AWS VPC
that allows us to create a secure network.
We've talked about routing
as a way of controlling the flow of traffic.
We've talked about NACLs
as like a firewall around the subnet as a whole.
Security groups are like a firewall
around specific EC2 virtual machines.
So whereas a NACL is applied to a subnet,
a security group is applied to individual instances.
Where a NACL is stateless
and does not remember traffic being in response.
A security group is stateful.
It does recognize traffic as being in response to something,
and what that means is that you don't have to
specify both ingress and egress.
You can specify one or the other.
Very much like NACLs, we specify the protocol as being
PCP, UDP, whatever it is.
We specify our source IP range
and our destination port range.
In this example,
kind of picking up from our previous example
where we were using a web application server,
we want to receive traffic on port 80 and 443,
from the internet.
So we want to make sure that this particular instance.
This virtual machine is allowed
to receive traffics on these two ports from anywhere.
These all zeroes meaning essentially anywhere.
Now he's an example of receiving.
Perhaps this is some kind of an application port.
A special port we're using for monitoring whatever it is,
and we want that to be allowed
from another particular instance.
Here we can use, instead of an IP range,
we can use the ID of another security group.
So that means that this, traffic is allowed on port 999
as long as it comes from a machine that has this particular
security group applied to it.
And we call that a reference.
It is a reference to another security group.
As we saw though in the previous example
about network access control list.
Even though the NACL allows port 22,
we still have to allow.
That gets it into the subnet,
but in order for those packets
to get into the virtual machine
that port also has to be open in a security group as well.
So we're also going to say that port 22 is allowed,
but we want to limit it to our corporate VPN.
At the range of 192.168 slash 16.
Here's the key difference between security groups
and NACLs being stateful verus stateless.
If you recall, when we talked about NACLs,
we had to explicitly open.
In order for response traffic on http and https connections
to get back out on the NACL
we had to specify the ephemeral range ports
for egress traffic.
We don't have to do that here in a security group,
because security groups are stateful.
They will recognize that outgoing traffic
is in response to packets that were initiated
on port 80 and 443.
So, the only time we really need to specify egress rules
are when we're talking about initiating connections.
And so here, what we're saying is that whatever machine
this security group is applied to
is allowed to make initiating connections
on port 3306 being to mice equal.
So long as those connections are being made to a machine
that has this security group applied to it.
Any other machine in the network
that does not have that security group applied,
this port will not being allowed to go out.
So again, that is considered a reference
when we mention the security group ID
rather than an IP range.
So again, to recap, network access control lists
are stateless and applied to a subnet.
Security groups are stateful
and applied to individual EC2 instances.
So here's another example, another way to look at that.
Another way to look at the relationship of security groups
is that security groups,
again you can see that they're applied
to the instance itself.
Not necessarily to the subnet as a whole,
but to the instance itself.
This one has security group.
This other EC2 has its own security group.
Perhaps, we might want to allow
remote JMX monitoring on port 7199.
We want to allow hdp and hdps ports coming in
from the open internet.
So it'll be allowed into the security group.
We're going to allow this security group
to initiate connections on port 3306 to our database.
So port 3306 will be allowed outbound on
as an initiating connection,
but everything else will be denied.
Now response traffic to hdp
and hdps traffic will be allowed,
but it's only the initiating,
the initial packet that we're blocking here in this example.
Now our database would also allow port 3306
to come into its security group
so long as that traffic originated
from this security group over here.