3 ms·
"Security groups allow you to set inbound and outbound firewall rules on your network." This is not correct. A SG is used to define per-instance inbound/outbou
by balls187 9y ago
"Security groups allow you to set inbound and outbound firewall rules on your network."
This is not correct. A SG is used to define per-instance inbound/outbound firewall rules. To say this applies to the network is misleading. To use an analogy--SG is like Windows Firewall.
Network-level "firewall" rules are done via Network ACL.
- rellimevad 9y agoYes and no. NACLs are, indeed, associated with a subnet so more of a networking construct. It's somewhat a firewall, but it's also stateless which is different than many (non-network engineer) people's mental model of a firewall. Security Groups have some key differences from a host-based firewall. A packet destined for an EC2 instance will not make it to the instance IP stack and be evaluated there, it will be evaluated before it gets there. It depends on your audience. A web dev that's relatively new to syadmin tasks... sure, it's like a host based firewall. For a syadmin or network admin, that explanation might be more confusing than helpful.
- felipelemos 9y agoBut SG are related to a network interface, not with your network (which would the VPC).
- mijndert 9y agoHi, Mijndert here, the author of the article. What you're saying is completely true, it's not factually accurate. What I was trying to achieve was come up with an analogy that's understandable for people coming from more traditional infrastructure. So while I agree this would cause some confusion for people who already know something about AWS, the intended audience will (hopefully) feel comfortable with this analogy.