Virtual firewall to control incoming and outgoing traffic to/from AWS

resources (EC2 instances, databases etc)

Provides additional layer of security - Defense in Depth

Security groups are default deny. NO RULES => NO ACCESS.

You can specify allow rules ONLY

You can configure separate rules for inbound and outbound traffic

Security Groups are stateful:

If an outgoing request is allowed, the incoming response for it is automatically allowed.

If an incoming request is allowed, an outgoing response for it is automatically allowed

You can add and delete security groups to EC2 instances at any time.

Changes are immediately effective

Traffic NOT explicitly allowed by Security Group will not reach the

EC2 instance