Security groups versus network ACLs: how do they differ and how would you use them together?

Summary

Security groups attach to network interfaces, are stateful, allow-only and can reference other security groups. Network ACLs attach to subnets, are stateless, evaluated in rule-number order and support deny. Use security groups for application-level least privilege; keep NACLs simple (allow-all plus a few deny rules as guardrails).

Longer Answer

Restrictive NACLs must allow return traffic on ephemeral ports in both directions, and are easy to get wrong. Security group references (app-sg -> db-sg) keep working as instances scale and are tighter than CIDR rules.

Key Points

• SG: stateful, ENI-level, allow-only.
• NACL: stateless, subnet-level, ordered, allow/deny.
• SG references for tiers.
• NACLs as coarse guardrails.

Deep dive: Networking Tutorial: Security Groups and Network ACLs

What interviewers look for

Clear differences and a sensible operating model.