Security Groups and Key Pairs

A security group is a virtual stateful firewall that controls inbound and outbound traffic to and from an EC2 instance (or other AWS resources like RDS, Lambda, ELB). Security groups operate at the instance level—each rule specifies a protocol (TCP/UDP/ICMP), port range, and source/destination (IP range or another security group). Unlike traditional firewalls, security groups are stateful: if you allow inbound traffic, the response traffic is automatically allowed outbound without an explicit rule.

Security groups have separate inbound and outbound rule sets. Inbound rules control traffic arriving at the instance—by default, all inbound traffic is denied. Outbound rules control traffic leaving the instance—by default, all outbound traffic is allowed. You add explicit Allow rules; there are no explicit Deny rules in security groups (use Network ACLs for explicit denies). All rules in a security group are evaluated together using a logical OR—any matching Allow rule permits the traffic.