Security Groups vs Network ACLs

Q: Can a security group rule reference another security group?

Yes, via UserIdGroupPairs. The rule then applies to any instance in the referenced group, so it follows instances rather than IP addresses.

Q: Can a network ACL explicitly deny traffic?

Yes. NACL entries support allow and deny, so they can block a specific CIDR. Security groups only allow - there is no deny rule.

Q: How do I remove a security group rule?

RevokeSecurityGroupIngress or RevokeSecurityGroupEgress with a permission shape that exactly matches the existing rule.

A VPC gives you two firewalls, and they are not redundant. Security groups are stateful and wrap individual instances; network ACLs are stateless and guard whole subnets. Confusing the two is the source of most "why is my traffic blocked" incidents.

This page shows both from the SDK, side by side, and makes the stateful-vs-stateless distinction concrete with code you can reason about.

Recipe

The common case is a security group: default-deny, with the specific inbound ports you allow. Because security groups are stateful, you only declare the inbound rule - the response is allowed automatically.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
 
sg = ec2.create_security_group(
    GroupName="web-sg", Description="web tier", VpcId="vpc-0abc123",
)
sg_id = sg["GroupId"]
 
ec2.authorize_security_group_ingress(
    GroupId=sg_id,
    IpPermissions=[{
        "IpProtocol": "tcp", "FromPort": 443, "ToPort": 443,
        "IpRanges": [{"CidrIp": "0.0.0.0/0", "Description": "HTTPS from anywhere"}],
    }],
)

// --- TypeScript (AWS SDK v3) ---
import {
  EC2Client, CreateSecurityGroupCommand, AuthorizeSecurityGroupIngressCommand,
} from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
 
const sg = await ec2.send(new CreateSecurityGroupCommand({
  GroupName: "web-sg", Description: "web tier", VpcId: "vpc-0abc123",
}));
const sgId = sg.GroupId;
 
await ec2.send(new AuthorizeSecurityGroupIngressCommand({
  GroupId: sgId,
  IpPermissions: [{
    IpProtocol: "tcp", FromPort: 443, ToPort: 443,
    IpRanges: [{ CidrIp: "0.0.0.0/0", Description: "HTTPS from anywhere" }],
  }],
}));

A new security group has no inbound rules (deny all in) and one default outbound rule allowing all traffic out. You add the inbound ports you need; the stateful engine handles the return path.

Working Example

Reference another security group as the source instead of a CIDR. This is how you say "the web tier may reach the database on 5432" without hardcoding any IP - the rule follows the instances, not their addresses.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
web_sg, db_sg = "sg-0web111", "sg-0db222"
 
ec2.authorize_security_group_ingress(
    GroupId=db_sg,
    IpPermissions=[{
        "IpProtocol": "tcp", "FromPort": 5432, "ToPort": 5432,
        "UserIdGroupPairs": [{"GroupId": web_sg,
                              "Description": "Postgres from web tier"}],
    }],
)

// --- TypeScript (AWS SDK v3) ---
import { EC2Client, AuthorizeSecurityGroupIngressCommand } from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
const webSg = "sg-0web111", dbSg = "sg-0db222";
 
await ec2.send(new AuthorizeSecurityGroupIngressCommand({
  GroupId: dbSg,
  IpPermissions: [{
    IpProtocol: "tcp", FromPort: 5432, ToPort: 5432,
    UserIdGroupPairs: [{ GroupId: webSg, Description: "Postgres from web tier" }],
  }],
}));

UserIdGroupPairs references another security group as the source. Any instance in web-sg can now reach any instance in db-sg on 5432, and instances added later inherit the rule automatically. To remove a rule, RevokeSecurityGroupIngress with the identical permission shape.

Deep Dive

Stateful vs Stateless, Concretely

Stateful (security group): when an instance allows inbound TCP 443, the response from the instance back to the client is allowed automatically, because the security group tracks the connection. You never write a matching outbound rule for the return traffic.

Stateless (network ACL): the NACL evaluates every packet independently with no memory of connections. If you allow inbound 443, the outbound response is not automatically allowed - you must add an outbound rule for it. And because the client's side of a TCP connection uses a random high port, that outbound rule has to allow the whole ephemeral port range (1024-65535), not port 443.

This ephemeral-port requirement is the number-one NACL gotcha. Forget it and connections establish inbound but the reply is dropped.

Creating a Network ACL

NACLs attach to subnets and use numbered rules evaluated lowest-first; the first match wins. Ingress and egress are separate rule sets, so a working web NACL needs both.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
 
acl = ec2.create_network_acl(VpcId="vpc-0abc123")
acl_id = acl["NetworkAcl"]["NetworkAclId"]
 
# inbound: allow HTTPS
ec2.create_network_acl_entry(
    NetworkAclId=acl_id, RuleNumber=100, Protocol="6",  # 6 = TCP
    RuleAction="allow", Egress=False,
    CidrBlock="0.0.0.0/0", PortRange={"From": 443, "To": 443},
)
# outbound: allow ephemeral return ports (stateless, so this is required)
ec2.create_network_acl_entry(
    NetworkAclId=acl_id, RuleNumber=100, Protocol="6",
    RuleAction="allow", Egress=True,
    CidrBlock="0.0.0.0/0", PortRange={"From": 1024, "To": 65535},
)

// --- TypeScript (AWS SDK v3) ---
import { EC2Client, CreateNetworkAclCommand, CreateNetworkAclEntryCommand } from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
 
const acl = await ec2.send(new CreateNetworkAclCommand({ VpcId: "vpc-0abc123" }));
const aclId = acl.NetworkAcl?.NetworkAclId;
 
// inbound: allow HTTPS
await ec2.send(new CreateNetworkAclEntryCommand({
  NetworkAclId: aclId, RuleNumber: 100, Protocol: "6",  // 6 = TCP
  RuleAction: "allow", Egress: false,
  CidrBlock: "0.0.0.0/0", PortRange: { From: 443, To: 443 },
}));
// outbound: allow ephemeral return ports (stateless, so this is required)
await ec2.send(new CreateNetworkAclEntryCommand({
  NetworkAclId: aclId, RuleNumber: 100, Protocol: "6",
  RuleAction: "allow", Egress: true,
  CidrBlock: "0.0.0.0/0", PortRange: { From: 1024, To: 65535 },
}));

Protocol is the IANA number as a string ("6" TCP, "17" UDP, "-1" all). Egress selects the direction. Rules are numbered so you can leave gaps (100, 200) and insert later. Unlike security groups, NACLs support explicit deny rules, which is why they are useful for blocking a specific bad CIDR.

Which Layer Blocked Me?

Because both layers apply - NACL at the subnet edge, security group at the ENI - a dropped packet could be either. The rule of thumb: security groups are stateful and default-deny inbound, so a missing SG rule is the usual culprit; if the SG looks right, check the NACL's ephemeral egress rules next. VPC Flow Logs (next page) record ACCEPT/REJECT and help pinpoint the layer.

Gotchas

Missing ephemeral egress on a NACL. Inbound works, replies drop. Allow outbound 1024-65535 for return traffic.
Expecting NACLs to be stateful. They are not. Every direction is independent; there is no automatic return path.
Writing outbound SG rules for return traffic. Unnecessary - security groups are stateful. The default allow-all egress already covers responses.
Rule-number collisions on a NACL. Two entries with the same number and direction conflict; each RuleNumber per direction must be unique.
Revoking with a mismatched shape. RevokeSecurityGroupIngress must match the existing rule's protocol, ports, and source exactly, or it removes nothing.
Deleting a security group still in use. A group attached to any ENI (or referenced by another group's rule) will not delete until detached.

Alternatives

Security groups alone are enough for most workloads; many teams leave the default NACL wide open and rely entirely on stateful SG rules.
Network ACLs add value as a coarse, stateless backstop - blocking a known-bad CIDR subnet-wide, or enforcing a hard boundary that a misconfigured SG cannot punch through.
AWS Network Firewall provides deep-packet, managed stateful inspection at the VPC edge when SG/NACL rules are too coarse.
AWS WAF filters HTTP(S) at the application layer (on ALB/CloudFront), which SGs and NACLs cannot inspect.

Use security groups as your primary control, add NACLs only where a subnet-wide stateless rule earns its complexity, and escalate to Network Firewall or WAF when you need layer-7 or deep inspection.

FAQs

What is the core difference between a security group and a network ACL?

A security group is stateful and attaches to network interfaces; return traffic is automatic. A network ACL is stateless and attaches to subnets; you must allow each direction explicitly.

Why do I need to allow ephemeral ports on a NACL?

Because it is stateless, the return leg of a connection uses a random high port (1024-65535) and is evaluated independently. Without an outbound rule for that range, replies are dropped.

Do I need outbound rules on a security group for responses?

No. Security groups are stateful, so responses to allowed inbound traffic are permitted automatically regardless of egress rules.

Can a security group rule reference another security group?

Yes, via UserIdGroupPairs. The rule then applies to any instance in the referenced group, so it follows instances rather than IP addresses.

Can a network ACL explicitly deny traffic?

Yes. NACL entries support allow and deny, so they can block a specific CIDR. Security groups only allow - there is no deny rule.

How are NACL rules evaluated?

By rule number, lowest first, and the first match wins for that direction. Ingress and egress are separate numbered rule sets.

What are the defaults for a new security group?

No inbound rules (all inbound denied) and one outbound rule allowing all traffic. You add the specific inbound ports you need.

How do I remove a security group rule?

RevokeSecurityGroupIngress or RevokeSecurityGroupEgress with a permission shape that exactly matches the existing rule.

If traffic is blocked, which layer do I check first?

The security group, since it defaults to deny-inbound. If it looks correct, check the NACL - most often a missing ephemeral egress rule. Flow Logs confirm which layer rejected.

VPC's Building Blocks, Programmatically - where SGs and NACLs sit in the object graph.
Subnets, Route Tables & Internet Gateways - the subnets a NACL attaches to.
VPC Flow Logs for Traffic Visibility - see ACCEPT/REJECT to find which layer blocked traffic.
VPC via SDK Best Practices - security-group hygiene and least-privilege rules.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

This page shows both from the SDK, side by side, and makes the stateful-vs-stateless distinction concrete with code you can reason about.

Recipe

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
 
sg = ec2.create_security_group(
    GroupName="web-sg", Description="web tier", VpcId="vpc-0abc123",
)
sg_id = sg["GroupId"]
 
ec2.authorize_security_group_ingress(
    GroupId=sg_id,
    IpPermissions=[{
        "IpProtocol": "tcp", "FromPort": 443, "ToPort": 443,
        "IpRanges": [{"CidrIp": "0.0.0.0/0", "Description": "HTTPS from anywhere"}],
    }],
)

// --- TypeScript (AWS SDK v3) ---
import {
  EC2Client, CreateSecurityGroupCommand, AuthorizeSecurityGroupIngressCommand,
} from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
 
const sg = await ec2.send(new CreateSecurityGroupCommand({
  GroupName: "web-sg", Description: "web tier", VpcId: "vpc-0abc123",
}));
const sgId = sg.GroupId;
 
await ec2.send(new AuthorizeSecurityGroupIngressCommand({
  GroupId: sgId,
  IpPermissions: [{
    IpProtocol: "tcp", FromPort: 443, ToPort: 443,
    IpRanges: [{ CidrIp: "0.0.0.0/0", Description: "HTTPS from anywhere" }],
  }],
}));

A new security group has no inbound rules (deny all in) and one default outbound rule allowing all traffic out. You add the inbound ports you need; the stateful engine handles the return path.

Working Example

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
web_sg, db_sg = "sg-0web111", "sg-0db222"
 
ec2.authorize_security_group_ingress(
    GroupId=db_sg,
    IpPermissions=[{
        "IpProtocol": "tcp", "FromPort": 5432, "ToPort": 5432,
        "UserIdGroupPairs": [{"GroupId": web_sg,
                              "Description": "Postgres from web tier"}],
    }],
)

// --- TypeScript (AWS SDK v3) ---
import { EC2Client, AuthorizeSecurityGroupIngressCommand } from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
const webSg = "sg-0web111", dbSg = "sg-0db222";
 
await ec2.send(new AuthorizeSecurityGroupIngressCommand({
  GroupId: dbSg,
  IpPermissions: [{
    IpProtocol: "tcp", FromPort: 5432, ToPort: 5432,
    UserIdGroupPairs: [{ GroupId: webSg, Description: "Postgres from web tier" }],
  }],
}));

Deep Dive

Stateful vs Stateless, Concretely

This ephemeral-port requirement is the number-one NACL gotcha. Forget it and connections establish inbound but the reply is dropped.

Creating a Network ACL

NACLs attach to subnets and use numbered rules evaluated lowest-first; the first match wins. Ingress and egress are separate rule sets, so a working web NACL needs both.

# --- Python (boto3) ---
import boto3
 
ec2 = boto3.client("ec2", region_name="us-east-1")
 
acl = ec2.create_network_acl(VpcId="vpc-0abc123")
acl_id = acl["NetworkAcl"]["NetworkAclId"]
 
# inbound: allow HTTPS
ec2.create_network_acl_entry(
    NetworkAclId=acl_id, RuleNumber=100, Protocol="6",  # 6 = TCP
    RuleAction="allow", Egress=False,
    CidrBlock="0.0.0.0/0", PortRange={"From": 443, "To": 443},
)
# outbound: allow ephemeral return ports (stateless, so this is required)
ec2.create_network_acl_entry(
    NetworkAclId=acl_id, RuleNumber=100, Protocol="6",
    RuleAction="allow", Egress=True,
    CidrBlock="0.0.0.0/0", PortRange={"From": 1024, "To": 65535},
)

// --- TypeScript (AWS SDK v3) ---
import { EC2Client, CreateNetworkAclCommand, CreateNetworkAclEntryCommand } from "@aws-sdk/client-ec2";
 
const ec2 = new EC2Client({ region: "us-east-1" });
 
const acl = await ec2.send(new CreateNetworkAclCommand({ VpcId: "vpc-0abc123" }));
const aclId = acl.NetworkAcl?.NetworkAclId;
 
// inbound: allow HTTPS
await ec2.send(new CreateNetworkAclEntryCommand({
  NetworkAclId: aclId, RuleNumber: 100, Protocol: "6",  // 6 = TCP
  RuleAction: "allow", Egress: false,
  CidrBlock: "0.0.0.0/0", PortRange: { From: 443, To: 443 },
}));
// outbound: allow ephemeral return ports (stateless, so this is required)
await ec2.send(new CreateNetworkAclEntryCommand({
  NetworkAclId: aclId, RuleNumber: 100, Protocol: "6",
  RuleAction: "allow", Egress: true,
  CidrBlock: "0.0.0.0/0", PortRange: { From: 1024, To: 65535 },
}));

Which Layer Blocked Me?

Gotchas

Missing ephemeral egress on a NACL. Inbound works, replies drop. Allow outbound 1024-65535 for return traffic.
Expecting NACLs to be stateful. They are not. Every direction is independent; there is no automatic return path.
Writing outbound SG rules for return traffic. Unnecessary - security groups are stateful. The default allow-all egress already covers responses.
Rule-number collisions on a NACL. Two entries with the same number and direction conflict; each RuleNumber per direction must be unique.
Revoking with a mismatched shape. RevokeSecurityGroupIngress must match the existing rule's protocol, ports, and source exactly, or it removes nothing.
Deleting a security group still in use. A group attached to any ENI (or referenced by another group's rule) will not delete until detached.

Alternatives

Security groups alone are enough for most workloads; many teams leave the default NACL wide open and rely entirely on stateful SG rules.
Network ACLs add value as a coarse, stateless backstop - blocking a known-bad CIDR subnet-wide, or enforcing a hard boundary that a misconfigured SG cannot punch through.
AWS Network Firewall provides deep-packet, managed stateful inspection at the VPC edge when SG/NACL rules are too coarse.
AWS WAF filters HTTP(S) at the application layer (on ALB/CloudFront), which SGs and NACLs cannot inspect.

Use security groups as your primary control, add NACLs only where a subnet-wide stateless rule earns its complexity, and escalate to Network Firewall or WAF when you need layer-7 or deep inspection.

FAQs

What is the core difference between a security group and a network ACL?

A security group is stateful and attaches to network interfaces; return traffic is automatic. A network ACL is stateless and attaches to subnets; you must allow each direction explicitly.

Why do I need to allow ephemeral ports on a NACL?

Because it is stateless, the return leg of a connection uses a random high port (1024-65535) and is evaluated independently. Without an outbound rule for that range, replies are dropped.

Do I need outbound rules on a security group for responses?

No. Security groups are stateful, so responses to allowed inbound traffic are permitted automatically regardless of egress rules.

Can a security group rule reference another security group?

Yes, via UserIdGroupPairs. The rule then applies to any instance in the referenced group, so it follows instances rather than IP addresses.

Can a network ACL explicitly deny traffic?

Yes. NACL entries support allow and deny, so they can block a specific CIDR. Security groups only allow - there is no deny rule.

How are NACL rules evaluated?

By rule number, lowest first, and the first match wins for that direction. Ingress and egress are separate numbered rule sets.

What are the defaults for a new security group?

No inbound rules (all inbound denied) and one outbound rule allowing all traffic. You add the specific inbound ports you need.

How do I remove a security group rule?

RevokeSecurityGroupIngress or RevokeSecurityGroupEgress with a permission shape that exactly matches the existing rule.

If traffic is blocked, which layer do I check first?

The security group, since it defaults to deny-inbound. If it looks correct, check the NACL - most often a missing ephemeral egress rule. Flow Logs confirm which layer rejected.

VPC's Building Blocks, Programmatically - where SGs and NACLs sit in the object graph.
Subnets, Route Tables & Internet Gateways - the subnets a NACL attaches to.
VPC Flow Logs for Traffic Visibility - see ACCEPT/REJECT to find which layer blocked traffic.
VPC via SDK Best Practices - security-group hygiene and least-privilege rules.

Stack versions: This page was written for boto3 1.43.x (Python 3.10+) and the AWS SDK for JavaScript v3 (Node.js 18+).

Security Groups vs Network ACLs

Search Documentation

Security Groups vs Network ACLs