Lesson 07 — Security Groups

Learning Path

☁️ Phase 2 – AWS Cloud Security

📘 Module 04 – Amazon VPC & Network Security

🎯 Lesson Objective

By the end of this lesson, you will be able to:

Understand Security Groups.
Differentiate inbound and outbound rules.
Configure Security Groups using AWS Console.
Configure Security Groups using AWS CLI.
Secure EC2 instances.
Apply Security Groups in enterprise environments.
Verify Security Group configurations.

📚 Lesson Information

Estimated Time: 2 Hours

Difficulty: Beginner

Prerequisites: Lesson 06 – Internet Gateway & NAT Gateway

Hands-on Lab: Yes

💼 Business Value

Every server connected to a network needs protection.

Imagine an office building.

Before anyone enters:

Security checks IDs.
Visitors are verified.
Employees have access only to authorised floors.
Delivery personnel use designated entrances.

AWS Security Groups work the same way.

They control who can communicate with AWS resources.

Without Security Groups:

Anyone could attempt to connect.
Attack surfaces increase.
Sensitive systems become exposed.
Compliance requirements may not be met.

Security Groups are one of the most important security controls in AWS.

🏢 CloudNova Scenario

CloudNova has deployed:

Public Load Balancer
Application Servers
Amazon RDS Database
Bastion Host

The Security Team defines the following requirements.

Customers may access the website over HTTPS.
Administrators may SSH only from the corporate office.
Application servers should only receive traffic from the Load Balancer.
Databases should only accept traffic from Application Servers.

As the Cloud Security Engineer, you will implement these requirements using Security Groups.

🌍 What is a Security Group?

A Security Group is a virtual firewall that controls traffic to and from AWS resources.

It works at the instance level.

Security Groups are commonly attached to:

EC2 Instances
Load Balancers
Amazon RDS
Amazon ECS
Amazon EKS
Lambda (inside a VPC)

Every Security Group contains:

Inbound Rules
Outbound Rules

🏗 Security Group Architecture

Internet

↓

Application Load Balancer

↓

Security Group

↓

EC2 Instance

↓

Security Group

↓

Amazon RDS

↓

Security Group

Each resource has its own Security Group based on its function.

🔐 Stateful Firewall

Security Groups are Stateful.

This means:

If inbound traffic is allowed,

the response traffic is automatically allowed.

Example:

Client

↓

HTTPS Request

↓

EC2

↓

HTTPS Response

↓

Automatically Allowed

No additional outbound rule is required for the return traffic.

📥 Inbound Rules

Inbound Rules define:

Who can connect to your resource.

Example:

Protocol	Port	Source
HTTPS	443	0.0.0.0/0
SSH	22	Corporate Public IP
HTTP	80	0.0.0.0/0

📤 Outbound Rules

Outbound Rules define:

Where your resource can communicate.

Example:

Protocol	Port	Destination
HTTPS	443	0.0.0.0/0
HTTP	80	0.0.0.0/0

Most environments allow outbound traffic unless stricter controls are required.

🏢 CloudNova Enterprise Security Groups

Security Group	Purpose
ALB-SG	Internet-facing Load Balancer
Web-SG	Web Servers
App-SG	Application Servers
DB-SG	Amazon RDS
Bastion-SG	Administrator Access

Enterprise Traffic Flow

Internet

↓

ALB-SG

↓

Web-SG

↓

App-SG

↓

DB-SG

Traffic is only permitted where explicitly required.

Security Group Referencing

Instead of allowing traffic from IP addresses, Security Groups can reference other Security Groups.

Example:

App-SG

↓

Allowed Source

↓

ALB-SG

Meaning:

Only resources using ALB-SG may communicate with the application servers.

This is an enterprise best practice.

🛠 Lab 01 — Create Security Groups (AWS Console)

Open:

AWS Console

↓

VPC

↓

Security Groups

Click

Create Security Group

Create Load Balancer Security Group

Setting	Value
Name	ALB-SG
Description	Application Load Balancer
VPC	CloudNova-VPC

Inbound Rules

Type	Port	Source
HTTP	80	0.0.0.0/0
HTTPS	443	0.0.0.0/0

Create Security Group.

Create Application Security Group

Setting	Value
Name	App-SG
Description	Application Servers

Inbound Rules

Type	Port	Source
HTTP	80	ALB-SG

Notice that the source is another Security Group.

Create Database Security Group

Setting	Value
Name	DB-SG
Description	Database Servers

Inbound Rule

Type	Port	Source
MySQL/Aurora	3306	App-SG

Only application servers may communicate with the database.

Create Bastion Security Group

Setting	Value
Name	Bastion-SG

Inbound Rule

Type	Port	Source
SSH	22	Your Public IP

Never use:

0.0.0.0/0

for SSH in production.

Attach Security Group

Navigate to

EC2

↓

Instances

↓

Select Instance

↓

Actions

↓

Security

↓

Change Security Groups

Attach the appropriate Security Group.

💻 AWS CLI Lab

List Security Groups

aws ec2 describe-security-groups

Create Security Group

aws ec2 create-security-group \
  --group-name ALB-SG \
  --description "Application Load Balancer" \
  --vpc-id vpc-xxxxxxxx

Tag Security Group

aws ec2 create-tags \
  --resources sg-xxxxxxxx \
  --tags Key=Name,Value=ALB-SG

Allow HTTP

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp \
  --port 80 \
  --cidr 0.0.0.0/0

Allow HTTPS

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0

Create Application Security Group

aws ec2 create-security-group \
  --group-name App-SG \
  --description "Application Servers" \
  --vpc-id vpc-xxxxxxxx

Allow ALB-SG to Access App-SG

aws ec2 authorize-security-group-ingress \
  --group-id sg-app \
  --protocol tcp \
  --port 80 \
  --source-group sg-alb

Create Database Security Group

aws ec2 create-security-group \
  --group-name DB-SG \
  --description "Database Servers" \
  --vpc-id vpc-xxxxxxxx

Allow App-SG to Access DB-SG

aws ec2 authorize-security-group-ingress \
  --group-id sg-db \
  --protocol tcp \
  --port 3306 \
  --source-group sg-app

View Security Groups

aws ec2 describe-security-groups

✅ Verification

Verify:

ALB-SG

↓

Allows

80

443

↓

Internet

App-SG

↓

Allows

80

↓

ALB-SG

DB-SG

↓

Allows

3306

↓

App-SG

Launch EC2 instances and confirm:

Public website loads.
Application server is not directly accessible from the Internet.
Database accepts traffic only from the application server.

🔍 Troubleshooting

Problem

Website cannot be accessed.

Check:

ALB Security Group.
Listener configuration.
EC2 Health Checks.
Route Tables.

Problem

Cannot SSH.

Verify:

Port 22 allowed.
Correct Public IP.
Key Pair.
Public IP assigned.

Problem

Application cannot connect to database.

Verify:

Database Security Group.
Port 3306.
Source Security Group.

Problem

Timeout when connecting.

Verify:

Route Tables.
Network ACLs.
Security Groups.
Instance Status.

🏢 Enterprise Notes

CloudNova standards:

One Security Group per application tier.
Never use one Security Group for every resource.
Reference Security Groups instead of IP addresses.
Restrict SSH to approved administrator IPs.
Remove unused rules regularly.
Review Security Groups during every security assessment.

🚫 Common Mistakes

❌ Allowing SSH from 0.0.0.0/0.

❌ Opening all ports.

❌ Using one Security Group for every server.

❌ Forgetting outbound rules.

❌ Allowing databases to accept Internet traffic.

❌ Leaving unused Security Groups attached.

🧪 DIY Challenge

Using your AWS account:

Create:

ALB-SG
App-SG
DB-SG
Bastion-SG

Configure:

HTTP and HTTPS to ALB-SG.
App-SG accepts HTTP only from ALB-SG.
DB-SG accepts MySQL only from App-SG.
Bastion-SG allows SSH only from your public IP.

Launch:

EC2 Web Server
EC2 Application Server

Attach the correct Security Groups.

Verify:

Website loads.
Application server cannot be accessed directly.
Database traffic is restricted.
SSH works only from your approved IP.

Take screenshots of:

Security Groups
Inbound Rules
Outbound Rules
EC2 Security Tab
AWS CLI output (describe-security-groups)

📊 Knowledge Check

What is a Security Group?
Is a Security Group stateful or stateless?
What is the difference between inbound and outbound rules?
Which AWS resources commonly use Security Groups?
Why is referencing another Security Group better than using IP addresses?
Why should databases never allow traffic from 0.0.0.0/0?
Which command lists Security Groups?
Why should SSH be restricted?
Can one Security Group be attached to multiple EC2 instances?
How do Security Groups improve enterprise cloud security?

💡 Key Takeaways

After completing this lesson, you should understand:

Security Groups act as stateful virtual firewalls that protect AWS resources.
Inbound rules control who can connect to a resource, while outbound rules control where it can communicate.
Security Group referencing is an enterprise best practice that simplifies secure communication between application tiers.
Restricting access based on the Principle of Least Privilege significantly reduces the attack surface.
Proper Security Group design is a critical responsibility of Cloud Security Engineers and forms the foundation of secure AWS networking.

🚀 Next Lesson

➡️ Lesson 08 — Network ACLs (NACLs)