Security Groups — Complete Guide
Security Groups — Complete Guide: free step-by-step lesson with examples, common mistakes, and interview tips — part of AWS Cloud Tutorial on Toolliyo Academy.
On this page
AWS Cloud Tutorial · Lesson 14 of 100
Security Groups
Core services → Projects
Core services · 1 — AWS basics · ~6 min · AWS — Networking & Security
What is this?
Security groups are stateful virtual firewalls at the ENI level. Rules allow traffic by protocol, port, and source (another SG or CIDR).
Why should you care?
AwsVerse allows app tier SG to talk to RDS SG on 5432 only — not the whole VPC.
See it live — copy this example
Run in AWS CloudShell / local AWS CLI v2, or follow the matching steps in the AWS Console (Free Tier).
aws ec2 authorize-security-group-ingress \
--group-id sg-app123 \
--protocol tcp --port 8080 \
--source-group sg-alb456What happened?
- Permits ALB security group to reach app servers on 8080.
- Using SG references is better than hard-coded IPs when instances scale.
Practice next
- Create sg-alb (443 from 0.0.0.0/0) and sg-app (8080 from sg-alb).
- Attach sg-app to EC2; verify no 22 open to world.
- Use Reachability Analyzer to test path.
- Remove wide CIDR rule; replace with sg reference.
- Add egress rule limiting outbound to sg-rds only.
Remember
SG = instance-level firewall. Reference other SGs for tiers. Default deny; add explicit allows.
AwsVerse API hardening
Pen test finds SSH open to world.
Outcome: SG tightened to SSM Session Manager only — no port 22.
Interview prep for this lesson
Practice these questions aloud after reading—each links to a full structured answer.
Sign in to ask a question or upvote helpful answers.
No questions yet — be the first to ask!
