A security group is a stateful, allow-only firewall attached to a resource such as an EC2 instance, so replies are let back in automatically. A network ACL is a stateless firewall on a whole subnet, with numbered allow and deny rules where the first match wins. Use security groups by default; use a network ACL when you must deny traffic or cover an entire subnet.
Last updated October 2026.
That last feature is why tier-to-tier rules belong in security groups. A network ACL can only name CIDR ranges.
Troubleshooting signal: requests reach the server but replies never return to the client. That is almost always a network ACL missing its outbound ephemeral-port rule. A security group cannot cause it, because security groups are stateful.
| Security group | Network ACL | |
|---|---|---|
| Scope | Resource (network interface) | Whole subnet |
| Rules | Allow only | Allow and deny |
| Evaluation | All rules, any allow passes | Lowest number first, first match wins |
| Return traffic | Automatic (stateful) | Needs its own rule (stateless) |
| Sources | CIDRs, prefix lists, other security groups | CIDRs only |
From the Amazon VPC user guide, checked 23 October 2026.
The requirement is "only this tier may talk to that tier", names specific instances or databases, involves sources that change as things scale, or asks for least privilege without managing return ports.
You must deny something, such as a hostile IP range; one rule must cover every resource in a subnet; or you want a subnet-wide guardrail in case an instance launches with the wrong security group.
The classic pair of questions tests both directions. "App servers in an Auto Scaling group must reach the database, and IPs keep changing" is a security group that references the app tier's group. "Block 198.51.100.0/24 from every instance in the public subnets now" is a network ACL deny rule numbered below the 443 allow. A deny rule in a security group is never right: security groups cannot deny.
A security group is a stateful, allow-only firewall attached to a resource; a network ACL is a stateless firewall on a subnet with numbered allow and deny rules. Security groups let replies back in automatically, while a network ACL needs explicit rules for return traffic.
No. Security groups support allow rules only. To block a specific IP range, use a network ACL deny rule with a lower rule number than any allow rule it must override.
Because network ACLs are stateless. The response to an allowed request goes back to a random high port on the client, and without an outbound rule covering that range the reply is dropped.
For inbound traffic, the subnet's network ACL is evaluated first, then the security group on the instance. Both must allow the traffic for it to arrive.
Chapter 10 of the Certified SAA-C03 course builds the tier chain and the ephemeral-port failure one step at a time, with two exam-style questions. Unit 1 is free.
Open Chapter 10 →