🔒 In-Depth Guide to AWS Security Groups with Terraform: Ingress, Egress, Ports, and Protocols

1. Introduction to AWS Security Groups

🔐 Security Groups are virtual firewalls for EC2 instances that control network traffic.
They manage ingress (incoming) and egress (outgoing) traffic, ensuring secure communication for your EC2 instances.

Key Concepts:

⚡ Ingress Rules: Control incoming traffic to EC2 instances.
🚪 Egress Rules: Control outgoing traffic from EC2 instances.
🌐 Stateful: Security Groups are stateful, meaning if you allow inbound traffic, the corresponding outbound response is automatically allowed.
🛡️ Multiple Security Groups: You can assign multiple security groups to an EC2 instance and define rules for each.

2. Ports and Protocols in AWS Security Groups

🔑 Ports:

🖥️ Port numbers define the services and applications that can communicate through your EC2 instances.
- Port 80: HTTP (Web traffic)
- Port 443: HTTPS (Secure Web traffic)
- Port 22: SSH (Remote login)
- Port 3389: RDP (Remote Desktop)

📡 Protocols:

🔁 TCP: Reliable connection-based protocol, used by most services (e.g., HTTP, SSH, database connections).
🚀 UDP: Faster, connectionless protocol, used for applications where speed is prioritized over reliability (e.g., DNS, video streaming).
⚡ ICMP: Connectionless protocol used for network diagnostics (e.g., ping, traceroute).

3. Ingress and Egress Rules

🛑 Ingress Rules:

These rules define which incoming traffic is allowed to your EC2 instance.

Example: Allow HTTP traffic (Port 80)

resource "aws_security_group_rule" "allow_http" {
  type              = "ingress"   # 🔥 Inbound traffic
  from_port         = 80          # 🔑 Port 80 for HTTP
  to_port           = 80          # 🔑 Allow to Port 80
  protocol          = "tcp"       # 📡 TCP Protocol
  cidr_blocks       = ["0.0.0.0/0"]  # 🌍 Any IP
  security_group_id = "sg-123456"   # 🛡️ Security Group ID
}

🎯 from_port = 80: Specifies incoming traffic on Port 80 (HTTP).
🌐 protocol = tcp: Indicates TCP protocol.
🌍 cidr_blocks = ["0.0.0.0/0"]: Allows access from any IP.

🚪 Egress Rules:

These rules define which outgoing traffic is allowed from your EC2 instance.

Example: Allow all outbound traffic

resource "aws_security_group_rule" "allow_all_egress" {
  type              = "egress"    # 🔄 Outbound traffic
  from_port         = 0           # 🔑 Any Port
  to_port           = 65535       # 🔑 Any Port
  protocol          = "-1"        # 🌐 Any Protocol
  cidr_blocks       = ["0.0.0.0/0"]  # 🌍 Any IP
  security_group_id = "sg-123456"   # 🛡️ Security Group ID
}

🎯 from_port = 0 and to_port = 65535: Allows all port numbers.
🌐 protocol = "-1": Specifies any protocol is allowed.
🌍 cidr_blocks = ["0.0.0.0/0"]: Allows all outgoing traffic to any destination.

4. Detailed Explanation of Protocols

🔁 TCP (Transmission Control Protocol):

🔒 Connection-oriented protocol ensuring reliable communication.
It guarantees that data is received in the correct order and is intact.

Example: Allow SSH (Port 22) for secure login

resource "aws_security_group_rule" "allow_ssh" {
  type              = "ingress"
  from_port         = 22          # 🔑 Port 22 for SSH
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["0.0.0.0/0"]  # 🌍 Any IP address
  security_group_id = "sg-123456"
}

🚀 UDP (User Datagram Protocol):

⚡ Connectionless protocol used in applications where speed is prioritized over reliability (e.g., video streaming, online gaming).
Doesn’t guarantee delivery or data order.

Example: Allow DNS (Port 53) queries

resource "aws_security_group_rule" "allow_dns" {
  type              = "ingress"
  from_port         = 53          # 🔑 Port 53 for DNS
  to_port           = 53
  protocol          = "udp"       # 📡 UDP Protocol
  cidr_blocks       = ["0.0.0.0/0"]  # 🌍 Any IP address
  security_group_id = "sg-123456"
}

⚡ ICMP (Internet Control Message Protocol):

🌐 Connectionless protocol for network diagnostics (e.g., ping, traceroute).
It doesn’t use ports; instead, it uses ICMP types (e.g., Echo Request, Echo Reply).

Example: Allow Ping (ICMP Echo Request)

resource "aws_security_group_rule" "allow_ping" {
  type              = "ingress"
  from_port         = -1          # ICMP doesn’t use ports
  to_port           = -1
  protocol          = "icmp"      # 📡 ICMP Protocol
  cidr_blocks       = ["0.0.0.0/0"]  # 🌍 Any IP
  security_group_id = "sg-123456"
}

🎯 from_port = -1 and to_port = -1: Indicates ICMP (no ports).
📡 protocol = "icmp": Specifies the ICMP protocol.

5. Private Subnet Communication with Public Subnet

To enable communication between a private subnet and a public subnet, set up a NAT Gateway or NAT instance in the public subnet. The private subnet will route its traffic through the NAT to access the internet, while the public subnet can communicate with the internet directly.

Key Points:

Public Subnet: Can access the internet directly.
Private Subnet: Cannot access the internet directly but routes its traffic through a NAT Gateway in the public subnet.
NAT Gateway: Allows outbound internet access for private instances while preventing inbound traffic.

6. Best Practices for Security Groups in AWS

🔒 Least Privilege: Only allow necessary traffic. For example, allow SSH (Port 22) only from trusted IP addresses.
🛡️ Specific CIDR Blocks: Avoid using 0.0.0.0/0—use more specific IP ranges to improve security.
🎯 Use Role-Based Security Groups: Assign different security groups based on roles (e.g., web server, database server).
🔄 Periodic Review: Regularly review and update security group rules to ensure they align with your security needs.
💡 Stateful Design: Since Security Groups are stateful, allowing inbound traffic automatically permits the corresponding outbound traffic.

7. Terraform Configuration for Security Groups (Ingress & Egress)

Here is a full example of a Terraform configuration for AWS Security Groups, including both ingress and egress rules:

resource "aws_security_group" "example" {
  name        = "example-security-group"
  description = "Allow HTTP and HTTPS access, restrict SSH to specific IP"

  # Ingress rule: Allow HTTP (Port 80) from anywhere
  resource "aws_security_group_rule" "allow_http" {
    type              = "ingress"   # 🔥 Inbound traffic
    from_port         = 80          # 🔑 Port 80 for HTTP
    to_port           = 80          # 🔑 Allow to Port 80
    protocol          = "tcp"       # 📡 TCP Protocol
    cidr_blocks       = ["0.0.0.0/0"]  # 🌍 Any IP
    security_group_id = aws_security_group.example.id
  }

  # Egress rule: Allow all outbound traffic
  resource "aws_security_group_rule" "allow_all_egress" {
    type              = "egress"    # 🔄 Outbound traffic
    from_port         = 0           # 🔑 Any Port
    to_port           = 65535       # 🔑 Any Port
    protocol          = "-1"        # 🌐 Any Protocol
    cidr_blocks       = ["0.0.0.

0/0"]  # 🌍 Any IP
    security_group_id = aws_security_group.example.id
  }
}

8. Conclusion

AWS Security Groups are essential for managing network traffic to your EC2 instances.
Ingress rules control inbound traffic, while egress rules manage outbound traffic.
By understanding how ports, protocols, and CIDR blocks work in conjunction with security groups, you can ensure that your AWS infrastructure is secure and well-managed.

These notes should help clarify the concepts of ingress and egress rules, ports, and protocols in AWS Security Groups. Feel free to experiment with these rules and configurations in Terraform for your own use cases!

Blog