AWS EC2 Security Groups Best Practices

Introduction

Security Group (SG) is the virtual firewall for EC2 instances. Stateful: return traffic is automatically allowed. Inbound and outbound rules are defined separately.

Default SG usually allows only traffic from same SG; create custom SGs in production.

This guide covers tiered architecture, least privilege, and audit strategies.

Basic Concepts

SG rules: Type, Protocol, Port, Source/Destination. 0.0.0.0/0 means open to entire internet; avoid for SSH/RDP.

An instance can attach multiple SGs; rules apply as union.

aws ec2 describe-security-groups --group-ids sg-0123456789abcdef0
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxx --protocol tcp --port 443 --cidr 10.0.0.0/8

Tiered Security Group Architecture

Web tier SG: 80/443 from ALB SG only. App tier: app port from Web SG. DB tier: 5432 from App SG only.

ALB has its own SG; traffic from internet to ALB, ALB to instances.

sg-alb: internet → ALB
sg-web: ALB → web
sg-app: web → app
sg-db: app → database

# Web tier - yalnızca ALB'den
Type: HTTP, Source: sg-alb-web
Type: HTTPS, Source: sg-alb-web

# App tier - yalnızca Web'den
Type: Custom TCP 8000, Source: sg-web

Least Privilege Principles

Use narrowest CIDR or SG reference per rule. Prefer single port over port range.

Restrict outbound too; default may allow all traffic. Allow only required endpoints.

# Kötü: SSH tüm internete
Source: 0.0.0.0/0, Port 22

# İyi: SSH yalnızca bastion SG
Source: sg-bastion, Port 22

Common Mistakes

Opening SSH/RDP with 0.0.0.0/0 is the most common mistake. Opening database port to internet is the second.

SG changes take effect immediately; test in staging. Do not forget to clean old rules.

Source olarak CIDR yerine SG referansı kullanın; IP değişse bile kural geçerli kalır.

Audit and Automation

AWS Config security-group-attached-to-ec2 rule. VPC Flow Logs traffic analysis. Security Hub findings.

Manage SGs as code with Terraform/aws_security_group; prevent drift.

resource "aws_security_group" "web" {
  name_prefix = "web-"
  vpc_id      = aws_vpc.main.id
  ingress {
    from_port       = 443
    to_port         = 443
    protocol        = "tcp"
    security_groups = [aws_security_group.alb.id]
  }
}

Conclusion

Security Groups are the primary defense of AWS network security. Apply tiered architecture, SG references, and least privilege.

Manage rules with regular audit and infrastructure-as-code.

Data Usage Notice