Security groups: the instance firewall

lesson 3-3 · ~10 min · 9/27

A firewall on every instance

A fresh server on the public internet starts collecting break-in attempts within minutes: automated scanners sweep the entire address space around the clock, probing every machine for open ports. A firewall is the defense: a filter that inspects network traffic and drops what is not allowed. In AWS, every EC2 instance gets one called a security group.

The rules of security groups:

Inbound traffic is denied by default. A rule must explicitly allow a port and a source. That should feel familiar, it is IAM's default deny from lesson 2-2 applied to the network.
Each rule names a port (443 for HTTPS, 22 for SSH, 5432 for PostgreSQL) and a source: an IP range like 0.0.0.0/0 (the whole internet), or another security group.
They are stateful: if an inbound request is allowed, its response is allowed back out automatically. No matching outbound rule needed.

A sane web server: allow 443 from 0.0.0.0/0, allow 22 from your office IP only, nothing else.

Port 443 has an allow rule and passes through to the instance. Port 3306 has no rule, so the security group drops it. Deny is the default, allow is the exception.

Code exercise · bash

This simulates a security group as a list of allowed ports. check answers like the firewall would. Run it, then trace why each line prints what it does.

Code exercise · bash

Your turn. Harden the group: this server should allow only SSH (22) and HTTPS (443), and you need to verify three probes: 22, then 80, then 5432. Edit the allowed list and the checks to produce the expected output.

Quiz

Your instance allows inbound 443 from anywhere and has no outbound rules for responses. A browser request on 443 arrives. Can the response get back out?