When should I use security groups instead of NACLs?

When should I use security groups instead of NACLs?

Security groups are used for instance-level security, while NACLs provide subnet-level security. Use security groups for specific instances and NACLs for broader control.

Can you give me an example of when to use each?

Sure! Use a security group to allow HTTP traffic to a web server instance. Use a NACL to block all inbound traffic to a subnet except for specific IP ranges.

Are there any limitations to using security groups?

Yes, security groups can only allow traffic; they cannot block it. Also, they are stateful, meaning if you allow inbound traffic, the response is automatically allowed.

What about NACLs? Are they stateful or stateless?

NACLs are stateless, meaning you need to define both inbound and outbound rules for traffic. If you allow inbound traffic, you must also allow the corresponding outbound traffic.