Summary

Adding AWS security group rules is an important task for managing the networking security policies of the EC2 service. You can configure access control for inbound/outbound traffic by specifying particular ports, protocols, and sources/destinations, and this can be performed in various ways, including through the AWS Console, CLI, and CloudFormation.

Details

1. Adding security group rules through the AWS Console

Basic steps

- Access the EC2 Console → Networking & Security → Security Groups

- Select the target security group → Click the security group to which you want to add rules

- Select the Inbound rules or Outbound rules tab

- Click Edit rules → Add rule

Rule configuration options

- Type: HTTP, HTTPS, SSH, Custom TCP/UDP, etc.

- Protocol: TCP, UDP, ICMP

- Port range: Single port (80) or range (8000-8080)

- Source/Destination:

   > IP address: 192.168.1.100/32

   > CIDR block: 10.0.0.0/16

   > Another security group: sg-12345678

   > Prefix list: pl-12345678

2. Adding security group rules through the AWS CLI

Adding an inbound rule (example)

# Allow HTTP traffic (port 80) 

aws ec2 authorize-security-group-ingress \

    --group-id sg-12345678 \

    --protocol tcp \

    --port 80 \

    --cidr 0.0.0.0/0

# Restrict SSH access to a specific IP

aws ec2 authorize-security-group-ingress \

    --group-id sg-12345678 \

    --protocol tcp \

    --port 22 \

    --cidr 203.0.113.100/32

Adding an outbound rule (example)

# Allow HTTPS outbound traffic

aws ec2 authorize-security-group-egress \

    --group-id sg-12345678 \

    --protocol tcp \

    --port 443 \

    --cidr 0.0.0.0/0

3. Common security group rule examples

Security group for a web server

- Inbound:

   > HTTP (80): Load balancer security group 

   > HTTPS (443): Load balancer security group 

   > SSH (22): Bastion security group or specific administrative IP (if SSH access is required)

- Outbound:

   > HTTPS (443): 0.0.0.0/0 (for package updates and external API calls)

   > Or selectively allow only the required destination IPs and ports

Security group for a database

- Inbound:

   > MySQL/Aurora (3306): Web/application server security groups only

   > PostgreSQL (5432): Web/application server security groups only

- Outbound: Selectively allow only the required destination IPs and ports

Security group for an internet-facing load balancer

- Inbound:

   > Allow configured listener ports from 0.0.0.0/0

   > (HTTP: 80, HTTPS: 443, etc., depending on the configuration)

- Outbound:

   > Instance ports and health check ports of the target group

   > Target: Security group of the target instances (referencing the security group ID is recommended)

Guidance

Security best practices

1. Principle of least privilege

- Allow only the required ports and protocols

- Specify sources as narrowly as necessary

   > When possible: Specific IP addresses (/32) or small CIDR blocks

   > Internal communication: Reference security group IDs (easier to manage than IP addresses)

   > Use 0.0.0.0/0 only when absolutely necessary

- Restrict administrative ports (SSH, RDP) to specific IP addresses only

2. Layered security

- Separate the web, application, and database layers

- Allow only the ports required between each layer

- Combine with Network ACLs for defense in depth

3. Rule naming and tag management

- Add a description for each rule

- Use security group names appropriate for their purpose

- Establish a management system using tags

4. Precautions

- Security group rule changes are applied immediately, so validation before applying them is recommended in production environments

- Rule changes are applied immediately, but existing sessions may remain active due to Connection Tracking

Considerations

1. Security group characteristics

- Stateful: Response traffic is automatically allowed when inbound traffic is allowed

- All rules are evaluated: Traffic is allowed if it matches any one of the allow rules

2. Limitations

- Up to 60 inbound rules per security group (an increase can be requested through Service Quotas)

- Up to 60 outbound rules per security group (an increase can be requested through Service Quotas)

- Up to 2,500 security groups per VPC (an increase can be requested through Service Quotas)

3. Change tracking

- Log API calls through CloudTrail

- Monitor compliance with Config Rules

- Conduct regular security group audits