Inbound traffic control
Outbound traffic filtering
Network segmentation
Zero-trust networking
DDoS mitigation
Database access restriction
VPN access control
Multi-tier application security

Quick Start

Minimal working example:

# aws-security-groups.yaml
Resources:
  # VPC Security Group
  VPCSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: VPC security group
      VpcId: vpc-12345678
      SecurityGroupIngress:
        # Allow HTTP from anywhere
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0
          Description: "HTTP from anywhere"

        # Allow HTTPS from anywhere
        - IpProtocol: tcp
          FromPort: 443
          ToPort: 443
          CidrIp: 0.0.0.0/0
          Description: "HTTPS from anywhere"

        # Allow SSH from admin network only
        - IpProtocol: tcp
// ... (see reference guides for full implementation)

Reference Guides

Detailed implementations in the references/ directory:

Guide	Contents
AWS Security Groups	AWS Security Groups
Kubernetes Network Policies	Kubernetes Network Policies
GCP Firewall Rules	GCP Firewall Rules
Security Group Management Script	Security Group Management Script

Best Practices

✅ DO

Implement least privilege access
Use security groups for segmentation
Document rule purposes
Regularly audit rules
Separate inbound and outbound rules
Use security group references
Monitor rule changes
Test access before enabling

❌ DON'T

Allow 0.0.0.0/0 for databases
Open all ports unnecessarily
Mix environments in single SG
Ignore egress rules
Allow all protocols
Forget to document rules
Use single catch-all rule
Deploy without firewall

network-security-groups

Network Security Groups

Table of Contents

Overview

When to Use