Amazon EC2 Security Groups

If you're using EC2-Classic, you must create security groups for each region in which you'll launch instances. When you launch an instance in EC2-Classic, you must specify a security group in the same region as the instance. You can't specify any security groups you created for EC2-VPC when you launch an instance in EC2-Classic.

Security group rules control the inbound traffic allowed to reach the instances associated with the security group. All other inbound traffic is discarded, and all outbound traffic is allowed by default.

If you're using EC2-VPC, you must create security groups specifically for your VPC. You can only specify the security groups for a VPC with instances in that VPC. You can't specify any security groups you created for EC2-Classic when you launch an instance in a VPC.

Security group rules control the inbound traffic allowed to reach the instances associated with the security group and the outbound traffic that can reach the Internet. All other traffic is discarded.

When you specify a security group for a nondefault VPC to the CLI or the API actions, you must use the security group ID and not the security group name to identify the security group.

Security groups for EC2-VPC have additional capabilities that aren't supported by security groups for EC2-Classic. For more information about security groups for EC2-VPC, see Security Groups for Your VPC in the Amazon Virtual Private Cloud User Guide.

Your AWS account automatically comes with a default security group for EC2-Classic. When you create a VPC, it automatically comes with a default security group. If you don't specify a different security group when you launch an instance, the instance is automatically associated with the appropriate default security group.

A default security group is named default, and it has an ID assigned by AWS. These are the initial settings for the default security group:

You can change the rules for a default security group. For example, you can add an inbound rule to allow SSH or Remote Desktop connections from specific hosts for the purposes of instance management.

You can't delete a default security group.

If you don't want all your instances to use the default security group, you can create your own security groups. You can create security groups that reflect the different roles your instances play in your system. For information about security groups for web servers and database servers, see Creating the WebServerSG and DBServerSG Security Groups in the Amazon Virtual Private Cloud User Guide.

When you create a security group, you must provide it with a name and a description. Security group names and descriptions can be up to 255 characters in length, and are limited to the following characters:

AWS assigns each security group a unique ID in the form sg-xxxxxxxx. The following are the initial settings for a security group that you create:

After you've created a security group, you can change its inbound rules to reflect the type of inbound traffic that you want to reach the associated instances. In EC2-VPC, you can also change its outbound rules. To allow instances that have the same security group to talk to each other, you must explicitly add rules for this.

When you launch an instance, you can associate it with one or more security groups. When deciding whether to allow traffic to reach an instance, we evaluate all the rules from all the security groups associated with the instance.

If you don't specify any security groups when you launch an instance, the instance is automatically associated with the default security group and uses the rules for that group.

After you launch an instance in EC2-Classic, you can't change its security groups. However, you can change the rules of a security group, and those changes are automatically applied to all instances that are associated with the security group.

The rules of a security group control the inbound traffic that's allowed to reach the instances associated with the security group. All outbound traffic is allowed by default. You can't change the outbound behavior for EC2-Classic.

You can't modify an existing rule in a security group. However, you can add and remove rules at any time. Your changes are automatically applied to instances associated with the security group after a short period.

For each rule, you define two settings:

Each inbound security group rule enables a specific source to reach the instances using a certain protocol (TCP, UDP, or ICMP) and destination port or ports (if the protocol is TCP or UDP). For example, a rule could allow IP address 203.0.113.1 (the source) to reach the instances on TCP port 22 (the protocol and destination port). If you specify ICMP as the protocol for the rule, you must also specify an ICMP type and code.

By specifying a security group as the source, you allow incoming traffic to reach all instances associated with the source security group. The incoming traffic that you allow is based on the private IP addresses of the instances associated with the source security group. The security group can be another security group in your AWS account, a security group in a different AWS account, or the security group itself. If the security group is in a different AWS account, prefix the security group name with the AWS account ID and a forward slash (for example, 111122223333/sg-edcd9784).

If you specify the security group itself as the source, each instance accepts inbound traffic from other instances associated with the security group. For example, the default security group specifies itself as a source security group in its inbound security group rules. This is why instances associated with the default security group allow inbound traffic from other instances associated with the default security group.

Security group rules are always permissive, so you cannot create any rules that deny access to a port. Also, if there is more than one rule for a specific port, the most permissive rule is always applied. For example, if you have a rule that allows access to port 22 from IP address 203.0.113.1, and another rule that allows access to port 22 from everyone, everyone has access to port 22.

When multiple security groups are applied to an instance, the rules from each security group are effectively aggregated to create one larger set of rules. The aggregated rules are then used to determine access to the instances.

In EC2-Classic, you can add up to 100 rules per security group. In EC2-VPC, you can add up to 50 rules per security group. If you need additional rules for an instance, you can assign it multiple security groups.