What is a Security Group in AWS

by
What is a Security Group in AWS

In this AWS article, we will discuss what is a security group in AWS and along with that, we will also discuss a few other topics as mentioned below.

  • AWS Security Groups Best Practices
  • AWS Default Security Group
  • AWS NACL vs Security Group

What is a Security Group in AWS

A Security Group is an important concept in AWS. Basically, it is like a virtual firewall for EC2 instances and helps you by controlling your traffic (Both inbound and outbound).

AWS provides you with a better level of security by providing Security Groups which has control over the inbound and outbound traffic associated with your EC2 instances.

The most important job of the Security Group in AWS is to filter the inbound and outbound traffic associated with the EC2 instances.

You can assign up to 5 number of Security Groups per EC2 instance based on your requirement.

If you are creating an EC2 instance using the command line or by using EC2 API, AWS will assign a default Security Group for your instance if you are not mentioning any security group by yourself.

But, in case you are launching your EC2 instance by using the Amazon EC2 console, then you have the provision to create your own AWS Security Group for your AWS EC2 instance.

Another important point is that Inside your Security Group, you will have to add a set of rules for controlling the inbound traffic of your EC2 instance and another set of rules for controlling the outbound traffic.

There is no importance of Security Groups without the rules.

AWS Security Groups Best Practices

By now, as we have already discussed the importance of AWS Security Groups, now it’s quite important to know the best practices for AWS Security Groups that you should follow while working with Security Groups.

Below is the list of a few AWS Security Groups Best Practices.

  1. The first and most important best practice that you should keep in mind is, You must make sure that there shouldn’t be larger ranges of port are open for your AWS security Groups. If you will do this mistake then you are providing a scope to the attackers for vulnerabilities.
  2. Since Outbound ports are open, you shouldn’t leave as it is. Rather, there should be some restrictions for the outbound access to some specific entities. Strictly, don’t ignore the Outbound ports.
  3. You should restrict the access to rarely use Ports where there is a high risk for malicious activities.
  4. It is better to restrict the redshift clusters and RDS instances because there is a high risk of malicious activities if not handled properly.
  5. You should closely look at the creation of any new Security Group and the ports that it is using. The ports it is using should not be kept open just like that rather the ports should be restricted to specific entities.
  6. It is always a better idea to keep the security Groups specific to different categories. To make this point very much clear, you can keep all your database connection ports under one specific Security Group and say you have some third party services, those connection ports you can keep under another specific Security Group. This will be easy to maintain.
  7. While naming a Security Group, Follow a proper naming conventions.

AWS Default Security Group

If you are creating an EC2 instance, AWS will assign a default Security Group for your EC2 instance if you are not mentioning any Security Group by yourself. It’s up to you whether you want to go with the default Security Group or not, if you don’t want to go with the default Security Group, you can create a custom Security Group by yourself.

Basically, AWS provides you with a default Security Group for each region for the default VPC that can be used, if you don’t want to use any custom Security Group.

If you are not using any custom Security Group, your EC2 instance will be attached to the default Security Group automatically.

Now, the point is, how you will recognize which one is the default Security Group. The answer is very simple, The name of the Default Security Group is “default” with an autogenerated ID.

Note: You are not allowed to delete a default Security Group. If you will try deleting a default Security Group, you will end up with an error. But you can add or remove a rule to or from a Security Group.

AWS NACL vs Security Group

Well, let’s discuss the difference between AWS NACL and AWS Security Group.

AWS NACLSecurity Group
Network Access Control List associated closely with Subnets in AWS.Associated with EC2 instance in AWS. No Subnet involved here.
Acts as a firewall for the subnet.Security Group acts as a firewall for the EC2 instance.
AWS NACL is stateless in nature Meaning if you will do any changes to the incoming rule, it won’t apply to the outgoing rule.Whereas, AWS Security Group is Stateful in nature. Meaning if you will do any changes to the incoming rule, it will apply to the outgoing rule automatically.
In terms of security, you can call it as the second layer of defense.In terms of security, you can call it as the first layer of defense.
AWS NACL supports both allow and deny rules. To make it clear, you can able to deny any specific IP address from establishing a connection. Security Group supports only allow rules. To make it clear, it is not possible to deny an IP address from establishing any connection. Another point to mention here is all the rules are denied here by default.

You may also like following the below articles

Wrapping Up

Well, hoping that by now, you have an idea of what is a security group in AWS, and along with that, we have also discussed the below topics.

  • AWS Security Groups Best Practices
  • AWS Default Security Group
  • AWS NACL vs Security Group

Hope you have enjoyed this article !!!