Security Groups and Network ACLs

Security groups

A security group is a stateful firewall attached to network interfaces (instances, containers, load balancers, databases):

• Allow rules only; anything not allowed is denied.
• Stateful: replies are allowed automatically.
• Sources can be IP ranges or other security groups.

A classic three-tier design:

SG_RULES = {
    "alb-sg": [("tcp", 443, "0.0.0.0/0")],
    "app-sg": [("tcp", 8080, "alb-sg")],
    "db-sg":  [("tcp", 5432, "app-sg")],
}

def allowed(source, target, port):
    for proto, rule_port, src in SG_RULES[target]:
        if rule_port == port and src in (source, "0.0.0.0/0"):
            return True
    return False

tests = [("internet", "alb-sg", 443), ("alb-sg", "app-sg", 8080), ("app-sg", "db-sg", 5432),
         ("internet", "db-sg", 5432), ("alb-sg", "db-sg", 5432)]
for src, dst, port in tests:
    print(f"{src:9} -> {dst:7} :{port:<5} {'ALLOW' if allowed(src, dst, port) else 'deny'}")

internet  -> alb-sg  :443   ALLOW
alb-sg    -> app-sg  :8080  ALLOW
app-sg    -> db-sg   :5432  ALLOW
internet  -> db-sg   :5432  deny
alb-sg    -> db-sg   :5432  deny

Network ACLs

Network ACLs are stateless rules on a whole subnet, evaluated in number order, with both allow and deny. Most teams leave them at "allow all" and use security groups, adding NACL deny rules only for subnet-wide guardrails such as blocking a known bad range.

Azure and Google Cloud

• Azure network security groups (NSGs) are stateful, have allow and deny rules with priorities, and attach to subnets or network interfaces. Application security groups play the "reference a group" role.
• Google Cloud VPC firewall rules are stateful, have priorities and allow/deny, and target instances by network tags or service accounts.