Security groups

The app didn’t need to send anything to customers. But a server does plenty of things on its own: it downloads updates, installs the app, and reports in to AWS. Every one of those is a connection the server starts.

This lesson is about getting those rules right: what a security group allows, what it quietly drops, and how to tell a network problem from a code problem in seconds.

A security group is a firewall attached to one resource: a server, a load balancer, a database. It’s a list of rules saying what may connect to that resource, and what the resource may connect to.

The route table decides whether traffic can find a path to a subnet. The security group decides whether the resource lets it in. Both have to say yes.

Four rules about how security groups behave

What’s in a rule

Each rule has three parts:

What a new security group allows

That outbound rule is the one Priya deleted. It looks unnecessary, which is why people remove it.

Name the group before, not an address range

A source can be another security group. The rule then means anything that has that security group attached, wherever it is and whatever its address.

That’s how QuickCart chains its three tiers, each one letting in only the one in front of it:

If the auto scaling group adds ten servers, the database rule needs no change: the new servers carry quickcart-app-sg, so they’re allowed. And if someone puts a test server in the app subnet without that group, it can’t reach the database, even though its address is in the same range.

Time-out or error: the fastest diagnosis you’ll ever make

Behind a load balancer the same rule holds. The load balancer tries to connect to a server for 10 seconds, then returns 504 Gateway Timeout. A 504 with nothing in the app’s logs almost always means a security group.

Network ACLs, briefly

A VPC has a second, older firewall: the network ACL. You’ll rarely change it, but you should recognise it.

Because a network ACL is stateless, a reply needs its own rule. Replies go back to the random high port the other side picked, called an ephemeral port, usually somewhere between 1024 and 65535. Forgetting that return rule is the classic network ACL mistake. QuickCart leaves the default network ACL alone and does all its filtering with security groups.

Below is QuickCart’s chain: load balancer, app, database, each with its own security group. Send a request with every rule right. Then break one rule at a time, send again, and watch the clock at the bottom. Finally, try a bug in the code instead.

What to notice: every broken rule gave the same result: a long wait, then a time-out, and nothing in the app’s logs about why. The bug in the code failed in a fraction of a second. How long a failure takes tells you where to look.

Pennies — security groups are free. The test server costs about two cents an hour while it runs, including its public IP address (prices change). You delete it at the end.

You’ll build QuickCart’s three-group chain, then launch one small server and see a time-out, a success and a refused connection with your own eyes. About 30 minutes.

Check the region selector at the top right says N. Virginia (us-east-1). The lab uses your account’s default VPC, which AWS creates in every region. If you deleted it, create the VPC from the VPC lesson and choose it instead, with a public subnet.

1. Create the load balancer's security group

   AWSIn the AWS console: EC2→Network & Security→Security Groups→Create security group

   Field	Enter
   Security group name	quickcart-alb-sg
   Description	QuickCart load balancer: HTTPS from anywhere
   VPC	your default VPC

   Under Inbound rules, choose Add rule:

   Type	Source
   HTTPS (port 443 fills in)	Anywhere-IPv4 (0.0.0.0/0)

   Leave Outbound rules as they are: one rule, All traffic to 0.0.0.0/0. Choose Create security group.

   You should see

   The group’s details page, with one inbound rule and one outbound rule.

2. Create the app's security group, pointing at the first

   AWSIn the AWS console: EC2→Network & Security→Security Groups→Create security group

   Field	Enter
   Security group name	quickcart-app-sg
   Description	QuickCart app servers: 8080 from the load balancer only
   VPC	your default VPC

   Under Inbound rules, choose Add rule:

   Type	Port range	Source
   Custom TCP	8080	Custom, then start typing quickcart-alb-sg and pick it from the list

   Leave the outbound rule. Choose Create security group.

   You should see

   The inbound rule’s source shows the ID of quickcart-alb-sg, starting sg-, instead of an address range.

3. Create the database's security group, pointing at the app

   AWSIn the AWS console: EC2→Network & Security→Security Groups→Create security group

   Field	Enter
   Security group name	quickcart-db-sg
   Description	QuickCart database: PostgreSQL from the app only
   VPC	your default VPC

   Type	Source
   PostgreSQL (port 5432 fills in)	Custom, then pick quickcart-app-sg

   Choose Create security group. That’s the whole chain: three groups, three inbound rules, and no address ranges except the front door.

4. Create a test group with no inbound rules

   Now you’ll see the three outcomes for yourself. Create one more group:

   AWSIn the AWS console: EC2→Network & Security→Security Groups→Create security group

   Field	Enter
   Security group name	quickcart-lab-sg
   Description	Lab: test time-outs from my laptop
   VPC	your default VPC

   Add no inbound rules. Choose Create security group.

5. Launch a small server running a web server on port 8080

   AWSIn the AWS console: EC2→Instances→Launch instances

   Field	Enter
   Name	quickcart-lab
   Application and OS Images	Amazon Linux 2023 AMI (the default)
   Instance type	t3.micro
   Key pair	Proceed without a key pair
   Network settings → Edit → Auto-assign public IP	Enable
   Firewall (security groups)	Select existing security group, then quickcart-lab-sg

   Open Advanced details. In the User data box at the bottom, paste this script. It runs once, as the server first starts:

   user dataCopy

   #!/bin/bash
   systemd-run --unit quickcart-web /usr/bin/python3 -m http.server 8080

   Part	What it means
   #!/bin/bash	run this script with bash
   systemd-run	start a program as a background service, so it keeps running after the script ends
   --unit quickcart-web	the service’s name
   /usr/bin/python3 -m http.server	Python’s built-in web server. Amazon Linux 2023 includes Python
   8080	the port it listens on, like QuickCart’s app

   Choose Launch instance. Wait until the instance shows Running and its status check shows 2/2 checks passed, about two minutes. Then select it and copy its Public IPv4 address.

6. Try it with no rule: a time-out

   On your computer, open Terminal and run the command below. Replace the highlighted address with the public IPv4 address you copied:

   TerminalCopy

   curl --max-time 5 http://203.0.113.10:8080

   Part	What it means
   curl	make a web request from the terminal and print the answer
   --max-time 5	give up after 5 seconds instead of waiting for minutes
   http://203.0.113.10:8080	your server’s public address, port 8080

   It waits five seconds, then:

   You should see

   curl: (28) Connection timed out after 5005 milliseconds

   The number of milliseconds will be slightly different. The web server is running, but quickcart-lab-sg allows nothing in, so your request was dropped and nothing replied.

7. Allow port 8080 from your address: success

   AWSIn the AWS console: EC2→Security Groups→quickcart-lab-sg→Inbound rules→Edit inbound rules

   Choose Add rule:

   Type	Port range	Source
   Custom TCP	8080	My IP

   My IP fills in your current public address with /32 on the end, meaning that one address only. Choose Save rules, then run the same curl command again.

   Straight away, you should see an HTML page that includes

   <title>Directory listing for /</title>

   No restart, no waiting. The rule applied within seconds.

8. Allow a port nothing listens on: refused

   Edit the inbound rules again and add one more:

   Type	Port range	Source
   Custom TCP	8081	My IP

   Save, then try port 8081. Use your address again:

   TerminalCopy

   curl --max-time 5 http://203.0.113.10:8081

   Part	What it means
   curl --max-time 5	the same request, with the same 5-second limit
   :8081	a port the security group now allows, but where no program is listening

   It fails at once, with a message like

   curl: (7) Failed to connect to 203.0.113.10 port 8081 after 97 ms: Couldn't connect to server

   Older versions of curl say Connection refused instead. Either way it’s fast: the packet got through the security group and the server itself answered “nothing here”. That’s a different problem from a time-out, with a different place to look.

9. Clean-up step: Clean up

   AWSIn the AWS console: EC2→Instances→quickcart-lab→Instance state→Terminate (delete) instance

   Confirm. Wait until its state is Terminated. A security group can’t be deleted while something is still using it.

   AWSIn the AWS console: EC2→Security Groups

   Delete the groups in this order, one at a time: select, then Actions → Delete security groups.

   Order	Group	Why this order
   1	quickcart-lab-sg	Free once the server is terminated
   2	quickcart-db-sg	Nothing refers to it
   3	quickcart-app-sg	The database group referred to it; now it’s gone
   4	quickcart-alb-sg	The app group referred to it; now it’s gone

   If you try them in another order, AWS refuses because another group’s rule still names that group. Delete the one that refers to it first.

   You should see

   None of the four quickcart- groups in the list, and no quickcart-lab instance except as Terminated, which disappears on its own after about an hour.