Security Groups

Inkwell's database is in a private subnet, so the internet cannot reach it. But the image job, a test server and anything else in the VPC still could. Inkwell wants a stricter rule: only the web servers may talk to the database, and only on the database port. That rule lives in a security group.

The rule

Security groups allow, never deny; replies come back free.

A security group is a virtual firewall attached to an instance's network interface. Every packet is checked against its rules:

• Allow rules only. A rule says which traffic is permitted: protocol, port, and source (inbound) or destination (outbound). Anything not allowed is dropped. You cannot write a "deny" rule.
• Stateful. If a request is allowed in, its reply is allowed out automatically, and the other way round. You do not write rules for return traffic.
• Defaults. A new group allows no inbound traffic and all outbound traffic.
• Sources can be other groups. Instead of an IP range, a rule can say "from anything carrying security group X".
• An instance can have several groups; the allowed traffic is the union of all their rules. Rule changes take effect immediately.

Inkwell's two groups:

Subnets have a second, separate firewall: the network ACL. It is stateless (return traffic needs its own rule), supports both allow and deny, applies to a whole subnet, and checks numbered rules in order. The default network ACL allows everything, so most teams do their real filtering in security groups.

The shortcut

For each server write one sentence: "Who may start a conversation with me, and on which port?" Each answer becomes one inbound rule. Everyone else is already refused.

The trap: opening SSH, port 22, to 0.0.0.0/0 "just for a minute". Bots scan for open port 22 constantly. Allow only your own address, or use Session Manager and open nothing.

Drills

Answer fast — trust the rule.

Remember

• Security groups allow, never deny; replies come back free (stateful).
• One sentence per server: who may start a conversation, on which port.
• Network ACLs are the stateless, subnet-level layer with deny rules; never open SSH to the world.