A security group is an AWS firewall configuration associated with resources such as EC2 instances, RDS databases, and EFS mount targets. Its rules control which network traffic may enter or leave those resources. One resource can have multiple security groups, and one group can be associated with multiple resources. section 5.4.1 section 9.2
Each rule specifies a direction, an IP protocol, a port, and a source or destination. That endpoint can be an IP address, an IP range, or—within AWS—another security group. A new security group allows no inbound traffic by default but allows all outbound traffic. Add only the inbound rules needed; for tighter outbound control, replace the default outbound rule with specific rules. section 5.4.1 section 5.4
Open a port to the right clients
For a WordPress application, allow internet HTTP traffic to the load balancer on port 80, but allow MySQL traffic to the RDS database on port 3306 only from the web servers’ security group. Referencing that group identifies the permitted clients without listing their individual IP addresses. section 2.1 section 10.4.2
The same pattern applies to other application components:
- For EFS, attach a client group to EC2 instances and allow its traffic into the mount target on NFS port 2049. section 9.2
- For ElastiCache, allow Redis traffic on port 6379 from the application servers’ client group rather than from every IP address. section 11.3.2
Resources:
# [...]
ClientSecurityGroup:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: 'cache-client'
VpcId: !Ref VPC
CacheSecurityGroup:
Type: 'AWS::EC2::SecurityGroup'
Properties:
GroupDescription: cache
VpcId: !Ref VPC
SecurityGroupIngress:
- IpProtocol: tcp
FromPort: 6379
ToPort: 6379
SourceSecurityGroupId: !Ref ClientSecurityGroup #1
This CloudFormation listing shows the client-group pattern: the cache group’s ingress rule uses SourceSecurityGroupId to permit traffic from instances associated with the client group. section 11.3.2
To test a rule change, try reaching the resource before and after updating its CloudFormation stack: an EC2 instance that initially rejects ping responds after an inbound ICMP rule is added. If traffic still fails unexpectedly, VPC Reachability Analyzer can simulate the path, and VPC Flow Logs can show rejected connections. Security groups address network access; IAM controls administration, while application authentication and other security measures remain separate responsibilities. section 5.4.2 section 5.4 section 11.3.1
