​
Overview

A security group is a set of rules attached to instances rather than to a network. Instances in the same group share its rules, and a rule can name another group as its source — so “the web tier may reach the database tier” becomes a rule instead of a list of addresses.
Navigation: Networking → Security Groups.
Security groups apply to basic networking, not to VPCs. If your account uses VPCs — which is the default — traffic is governed by firewall policies on the network tier instead, and security groups will not be part of your setup.Both exist in the product because the underlying platform supports both models. Which one applies is decided by how your zone is configured, not by a preference you set.

​
Security groups versus firewall policies

​
Creating a group

A group needs only a name; a description is optional. A group with no rules denies all inbound traffic and permits all outbound.

​
Rules

Rules are added per direction — ingress for inbound, egress for outbound. The form adapts to the protocol: port fields appear for TCP and UDP, ICMP type and code for ICMP, and neither for All. Validation you’ll see:
Referencing another group is the feature worth using. A rule saying “allow 5432 from web-servers” keeps working as web instances are added and removed, where a CIDR list needs maintaining. It is also self-documenting — the rule states the intent rather than an address range you have to decode later.

​
Rules are permissive, not ordered

Security group rules have no priority and no deny. Every rule permits something, and traffic is allowed if any rule matches. Adding a rule can only widen access; removing one is the only way to narrow it.That is the opposite of firewall policies, which are numbered and where the first match wins. Don’t carry assumptions from one model to the other.

​
Membership

Group membership is set when an instance is deployed and cannot be changed afterwards through the console.
Plan an instance’s groups before creating it. Changing them later means recreating the instance, which is a much bigger job than editing a rule — so prefer several narrow groups you can combine at deploy time over one broad group you would need to edit.

​
Deleting a group

A group that is still attached to an instance cannot be deleted. The confirmation states what goes with it: the group’s ingress and egress rules.

Firewall Policies

The VPC equivalent, and what most accounts use.

Networking overview

How the networking models differ.

Virtual Machines

Where group membership is set.

Public IPs

Publishing an instance.