Understanding AWS Security Groups

TechOps Examples

Hey — It's Govardhana MK 👋

Along with a use case deep dive, we identify the remote job opportunities, top news, tools, and articles in the TechOps industry.

👋 Before we begin... a big thank you to today's sponsor SUPERHUMAN AI

Find out why 1M+ professionals read Superhuman AI daily.

In 2 years you will be working for AI

Or an AI will be working for you

Here's how you can future-proof yourself:

1. Join the Superhuman AI newsletter – read by 1M+ people at top companies

2. Master AI tools, tutorials, and news in just 3 minutes a day

3. Become 10X more productive using AI

Join 1,000,000+ pros at companies like Google, Meta, and Amazon that are using AI to get ahead.

Sign up and start learning AI

IN TODAY'S EDITION

🧠 Use Case

• Understanding AWS Security Groups

🚀 Top News

• 2025 Kubernetes Cost Benchmark Report Out Now!

  Key Highlights:

  • AWS Spot instances interrupted 50% within first hour

  • Azure offers highest Spot discounts, up to 90%

  • Google offers lowest On Demand price for A100 GPUs

    more details here.

👀 Remote Jobs

• Slash Digital is hiring a Senior DevOps Engineer

  Remote Location: Worldwide

• GitLab is hiring a Site Reliability Engineer

  Remote Location: APAC

📚️ Resources

• How to Read System Logs Without the Headache

• Master Prompt Engineering (One For ALL) - Ultimate Repo

• Jenkins or GitHub Actions? Deciding the Right CI/CD Tool for Your Workflow

📢 Reddit Threads

• People who don't use GitOps. What do you use instead?

• Does GitHub uses GitHub to build GitHub? can GitHub rollback GitHub to fix GitHub when GitHub is down?

🛠️ TOOL OF THE DAY

Kluctl - Unifies complex Kubernetes deployments into a single declarative framework.

• Integrates with Helm and Kustomize.​

• Supports diffs and dry runs.​

• Facilitates GitOps workflows.​

🧠 USE CASE

Understanding AWS Security Groups

AWS Security Groups (SGs) are stateful firewalls controlling inbound and outbound traffic at the instance level. Security Groups attach directly to EC2 instances, RDS, ALB, Lambda (in VPC), etc.

By default:

• All inbound traffic is blocked. You must explicitly allow it.

• All outbound traffic is allowed. Unless you restrict it.

Since SGs are stateful, if an inbound request is allowed, the response is automatically allowed (you don’t need an outbound rule for responses)

Every rule in a Security Group has the following technical parameters:

Security Groups can reference other Security Groups instead of IPs. This is critical when working with multiple tiers (Load Balancer → App Server → Database)

Use Case: ALB to Web Server

• Instead of exposing your Web Server to 0.0.0.0/0, allow only traffic from the ALB’s SG.

• This way, only traffic from the ALB is allowed.

Why? If the ALB’s IP changes, the rule still works because it references an SG dynamically.

Debugging Security Group Issues

1. Check Security Group Rules

aws ec2 describe-security-groups --group-ids sg-12345678

Look for missing rules if traffic isn’t working.

2. Check if the Instance is Associated with the Right SG

aws ec2 describe-instances --query 'Reservations[].Instances[].SecurityGroups'

An instance can have multiple Security Groups, ensure the right one is attached.

3. Use VPC Flow Logs to Detect Blocked Traffic

• If traffic never reaches your instance → Wrong Security Group rule.

• If the request reaches but gets no response → Application issue.

Things to Remember:

✅ Use Security Groups, not static IPs in rules.
✅ Avoid “allow all” rules (0.0.0.0/0) unless necessary.
✅ Don’t allow 0.0.0.0/0 inbound for SSH or databases.
✅ Use IAM roles for permissions, not security groups alone.
✅ Regularly audit SGs to remove unused or overly permissive rules.
✅ Only allow necessary ports (e.g., SSH from a trusted IP, HTTP from the internet).

My 2 cents:

Security Groups are not just allow/deny rules. They’re dynamic, stateful, and critical for AWS security.

So keep them tight, specific, and regularly reviewed.

Looking to promote your company, product, service, or event to 40,000+ Cloud Native Professionals? Let's work together.