- Now let's take a look at another demo,
where we'll create another security group within AWS VPC.
Okay, so from the dashboard, the AWS console,
again, I'm going to filter by the right VPC,
and so far, we have created a VPC,
we've created some public subnets,
we've routed them to and from the internet
with our public-traffic Route Table.
We have created a Network Access Control List
for web-traffic, tightened the security for that,
you can see we're allowing HTTP and HTTPS traffic
into that subnet, and allowing ephemeral ports out.
Again, just as a reminder, Network Access Control Lists
apply to the subnet as a whole.
We still need a way to secure the instance itself,
a firewall for the individual machine.
And we can do that with Security Groups.
So this particular VPC, like all VPCs,
will come with a default Security Group,
but it's generally best practice to create
Security Groups per purpose, so for a web server,
we have a web server Security Group,
for an application server or database server,
they each get their own specific Security Group
that's more specialized to what that machine
is actually doing.
So from here I'm going to click Create Security Group,
I'm going to call this one web-server,
I'm going to describe this as web application security,
make sure that we're choosing the appropriate VPC,
and create that.
Now that we have the web server, you can see,
here we have our web-server Security Group,
so far, by default, we do not have any inbound rules,
that means that whatever EC2 instance this Security Group
is attached to, cannot receive any traffic
until we open this Security Group up,
so I'm going to Edit that, again,
I'm going to allow it to receive,
HTTP traffic from anywhere,
I'm going to allow it to receive HTTPS,
and again, I'm going to choose from anywhere.
I'm going to save that.
Now whatever EC2 instance we apply this Security Group to,
will be allowed to receive traffic on port 80 and 443.
It might seem like we're doing double work,
but we're doing things for different purposes.
We've added very similar rules to the NACLs
that our subnet can receive traffic.
We've added these same rules to the Security Group
so that our instance can receive traffic.
Now, as a reminder, the difference between NACLs
and Security Groups is that the NACL was stateless,
that's why we had to specify both inbound
and outbound rules.
The Security Group, being state full,
means that we don't have to specify outbound rules.
And again, that is for response traffic.
If a request comes in on one of these two ports,
and then the response goes back out,
the Security Group will allow that,
so we really don't have to mess with outbound rules.
I do wanna point out that Security Groups, by default,
do allow all outbound traffic to all destinations,
but what this is talking about are the initiation packets.
That initial connection,
it's now talking about response packets.
So that is how we create a Security Group within AWS VPC.