AWS Security group (SG)

Security groups are stateful firewalls

• https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html

• Default security group

AWS CLI

• aws ec2 create-security-group
• aws ec2 describe-security-groups
• aws rds describe-db-security-groups
• aws ec2 delete-security-group
• aws ec2 authorize-security-group-ingress
• aws ec2 authorize-security-group-egress
• aws ec2 describe-instance-attribute --instance-id i-00b1cf99a8xxx --attribute groupSet
• aws ec2 describe-instances | grep "GroupName|GroupId"

• Terraform resource: aws_security_group, aws_security_group_rule
• Terraform security-group module

Load balancers

• Security groups for your Application Load Balancer (ALB)
• Security groups for your Network Load Balancer (NLB) (do not have)

Activities

• Read: https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-delete-vpc-sg/
• Read Update your security groups to reference peer security groups

Best practices

• Authorize only specific IAM principals to create and modify security groups

Related

• CidrIp
• cidr_blocks
• Network ACL
• aws_security_group, aws_network_interface_sg_attachment
• aws rds create-db-security-group
• Security groups for Pods
• Unrestricted Security Group Ingress

See also

• Terraform Security Group: aws_security_group, aws_security_group_rule, aws_network_interface_sg_attachment
• AWS Security group (SG): aws ec2 [ create-security-group | describe-security-groups | delete-security-group | authorize-security-group-ingress | authorize-security-group-egress ]
• Security Group, DBSecurityGroup, aws_security_group, aws_security_group_rule, VpcSecurityGroupId, AWS::EC2::SecurityGroup, Security groups for Pods in EKS