Question: what is the difference between security group and nacl?
Answer: Security groups are tied to an instance whereas Network ACLs are tied to the subnet. i.e. Network Access control lists are applicable at the subnet level, so any instance in the subnet with an associated NACL will follow rules of NACL. ... This means any instances within the subnet group gets the rule applied.