Overview of AWS Security Group
Tags: aws, cloudcomputing, devops, security
Published: 2023-07-25 01:17:36

In the world of Cloud Computing, we design everything with **Security in mind.** While you may have heard about AWS Security Groups — have you ever stopped to think about what a security group is, and what it actually does?

## What is a Security Group?
A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. For each security group, you add rules that control the inbound traffic to instances, and a separate set of rules that control the outbound traffic. 

Security groups are acting as a "firewall" on EC2 instances.
They regulate:
- Access to ports
- Authorized IP ranges (IPv4 and IPv6)
- Controls inbound network (from other to the instance)
- Controls outbound network (from instance to other)

## What to know about Security Groups?

- It can be attached to multiple instances within a security group.
- Locked down to a region / VPC combination.
- It lives "outside" the EC2 - if traffic is blocked the EC2 instance won't see it.
- If an application is not accessible (time out), then it's a security group issue.
- If an application gives a connection error, then it's an application error, or the application isn't launched.
- By default, all inbound traffic is blocked and all outbound traffic is authorized.

_NB: It is good to maintain one separate security group for SSH access_

## Security group rules
**Inbound:** Inbound rules control the incoming traffic to reach the instances that are associated with the security group.

**Outbound:** Outbound rules control the traffic to leave the instances that are associated with the security group.

_NB: For each inbound and outbound rule, you can add, update, or remove rules that take effect immediately in all instances associated with the security group._ 

**Each rule consists of the following key elements:**
**Name:** The name for the security group (for example: webserver-security-group, database-security-group).

**Protocol:** The network protocols to allow (for example: TCP, UDP, ICMP, etc.).

**Port range:** A specific port or the range of ports to allow traffic on (for example: 80, 22, 7000-8000, etc.).

**Source or destination:** The source (inbound rules) or destination (outbound rules) for the traffic that can specify by an IP, IP range, or other security groups.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1ttau0tr7tg3fk8mvf2h.png)


## Ports to know

- 22 = SSH (Secure Shell) - Log into a Linux instance
- 3389 = RDP (Remote Desktop Protocol) - Log into a Windows instance.
- 22 = SFTP (Secure File Transfer Protocol) - Upload files using SSH.
- 21 = FTP (File Transfer Protocol) - Upload files into a file share.
- 80 = HTTP (Hyper Text Transfer Protocol ) - Access unsecured websites.
- 443 = HTTPS (Hyper Text Transfer Protocol Secure) - Access secured websites.

## Let's practice on our AWS console

**1. Create an EC2 instance and launch it, check if it is running.**
![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v9b37qmvh7r7fmxtlvxb.png)


**2. Under Network & Security, click Security Groups**
_You see two Security Groups, Default Security Group created by default and Launch-wizard-1 Security Group created when the EC2 instances was launched._

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rq3atm3n6ok2stbdi956.png)


**3. Click on the security group to edit the inbound rules**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4tm2xsbhjtwe3pg8iul8.png)



**4. Inbound has two rules**
_HTTP which allows port 80 in the EC2 instances from anywhere_
_SSH which allows port 22 in the EC2 instances from anywhere_


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uxbk8cby1wr76mqzfads.png)


**5. Add more rules**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ugmzu5cako2m4ir9f494.png)


**6. Delete the rule**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0d3nt17ujllu5kufp4fb.png)


**7. Edit the rule**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0nb097m86l7gaan9i7ij.png)



_Cloud to the world_