Security Group – A security group is a virtual firewall that controls traffic at the instance level in cloud environments such as Amazon Web Services (AWS), Microsoft Azure, or Google Cloud. Security groups allow controlling both inbound and outbound traffic for resources in a virtual network, such as a VPC (Virtual Private Cloud). Let’s explore the main aspects of working with security groups in more detail.

1. Purpose of Security Group

A Security Group is used to manage access to resources such as virtual machines (EC2 in AWS) or containers running in the cloud. It regulates the following types of traffic:

• Inbound traffic: Controls incoming requests to an instance.
• Outbound traffic: Controls the traffic that an instance sends to other networks or the internet.

Security groups protect resources by filtering traffic based on parameters such as IP address, port, and protocol.

2. How It Works

Security groups are stateful, meaning:

• When you allow an inbound connection, the response outbound connection is automatically allowed.
• Similarly, if an outbound connection is allowed, the response inbound connection will also be automatically allowed.

For example, if a request is sent from your resource, the response to that request will always be allowed, regardless of the inbound security group rules.

3. Key Components of a Security Group

A security group consists of rules that define which traffic is allowed to or from the resource.

3.1. Inbound Rules
Inbound rules define which traffic can reach the resource:

• Traffic source: You can specify an IP address or address range (e.g., 192.168.1.0/24) or another security group.
• Protocol: A specific protocol (e.g., TCP, UDP, ICMP) or allow all protocols.
• Port: A specific port or range of ports (e.g., 22 for SSH). Example: A rule that allows SSH access (TCP port 22) from the IP address 203.0.113.0.

3.2. Outbound Rules
Define which traffic the resource can send:

• Traffic destination: Specify the IP address or address range where traffic will be sent.
• Protocol and port: Choose the protocol and port. Example: A rule that allows all outbound traffic to port 80 (HTTP) for all IP addresses.

4. Limitations

There are certain quotas for security group usage:

• Security groups per interface: The maximum number of security groups that can be attached to a single network interface (e.g., in AWS, up to 5 groups per interface).
• Number of rules: The maximum number of rules per security group (e.g., in AWS, up to 60 rules per group).
• Security groups per VPC: There is a limit to the number of security groups that can be created in a VPC (e.g., in AWS, up to 2500 groups per VPC).

5. Characteristics of Security Group

• Stateful: As mentioned earlier, a security group tracks connections, which allows automatic allowance of return packets.
• Resource association: A security group can be assigned to one or more resources within the same VPC.
• Dynamic updates: Changes to security group rules are applied instantly without requiring a reboot or restart of resources.

6. Benefits of Security Group

• Simplified management: Instead of configuring firewall rules for each instance, you can create security groups for different resources with the same requirements.
• Centralized management: Changes to security group rules are immediately applied to all resources associated with that group.
• Flexibility and security: Security groups allow control over traffic at the application or network level, maintaining high isolation and protection for resources.

Security Group is a powerful tool for managing security in a cloud environment, helping to control access to resources and ensuring high flexibility and reliability.

To create a Security Group:

Go to Network > Security Groups. Click Create on the top toolbar.