4.5 Security Groups Lab

What is DMZ

DMZ or demilitarized zone (sometimes referred to as a perimeter network) is a physical or logical subnetwork that contains and exposes an organization's external-facing services to an untrusted network, usually a larger network such as the Internet. The purpose of a DMZ is to add an additional layer of security to an organization's local area network (LAN); an external network node can access only what is exposed in the DMZ, while the rest of the organization's network is firewalled. The DMZ functions as a small, isolated network positioned between the Internet and the private network.

What is Security Group (SG)

Security group is a virtual firewall and it's controlling traffic to your instances. When you first launch an EC2 instance you associate it with one or more security groups, and you can add rules to each security group that allows traffic to or from instances.

Essentially, a security group is your first line of defense against hackers. If you lock down your SSH port to your IP address it means that hackers would not be able to even SSH into your instance.

In your console, and go to Security Groups. and click on one of your security group, you will see:

Description tab:

There are Group name, Group ID, Group description and VPC ID.

Inbound tab:

Your inbound traffic, such as SSH, HTTP, HTTPS. You can edit these rules in this tab. Any rule you make to a security group applies immediately. If you delete your HTTP rule, you will not connect to your instance from browser immediately. You can only configure what type of traffics are allowed to come in, but you cannot deny any specific traffic type. All inbound traffic types are blocked by default. You also cannot deny a specific IP address using Security Groups, but you can do that using Network Access Control List (This will be discussed in detail in VPC section).

Outbound tab:

Usually, the type is All traffic. It means it can connect to any IP address and port number. Security Group is Stateful, it means when you add a inbound rule, that rule will be automatically allowed back out. It doesn't matter that you have no outbound rules whatsoever. As soon as you add an inbound rule, outbound rules are added automatically, so anything you allow in will go out as well. All outbound traffic types are allowed by default. You can only filter destination by adding outbound rules. In the contrary, Network Access Control List is Stateless (This will be discussed in detail in VPC section).

Tags tab:

There are your tags for this Security Group.

Tips You Should Know:

• The instances in a same Security Group can communicate with each other, and it doesn't matter what Region you go into. The source of them are same, it is the source of this Security Group.

• You can have any number of EC2 instances within a Security Group, and you can also associate multiple security groups to one instance. You can go to Actions -> Networking -> Change Security Groups, and then you can add/remove more Security Groups to/from the instance.