Question: acls are stateless and security groups are stateful?
Answer: Network ACL supports Allow and Deny rules. Security Group is Stateful, any changes applied to an incoming rules is automatically applied to an outgoing rule. Network ACL is Stateless changes applied to incoming will not be applied to Security Group.