World map

 

BM

World A3: The Mall's Roads

Security groups and NACLs

You will learn: the two guards, the unit's door and the row's gate, and how to let only the right visitors in.

Checked with AWS 2026-11 on 1 Nov 2026

The problem

Tap each point on the timeline.

One loose rule, and the whole street knocks. Tap the story. Who should guard the door?

Watch

A Security group: The guard at a unit's door. Allow rules only, and it remembers who came in, so replies go out. is the guard at your unit’s door. It has allow rules only. Let shoppers in on 443. Let only your laptop use SSH.

Set the door guard's rules. Only the right visitors get in.

Visitors

  • Shoppershould get inTCP 443 from 198.51.100.20Its replies go back to ports 49152–65535.
  • Your laptop (SSH)should get inTCP 22 from 203.0.113.9Its replies go back to ports 32768–61000.
  • Stranger (SSH)keep outTCP 22 from 192.0.2.77Its replies go back to ports 32768–61000.

Unit door · security group (the server)

Allow rules only. It remembers who came in, so replies always go out.

In

No In rules yet: nothing gets in.

Out: all traffic (a new group starts this way).

Watch

A Network ACL: The gate of a whole row. Numbered allow and deny rules, lowest first. It remembers nothing. is the gate of the whole row. It remembers nothing. A shopper got in on 443. Their reply leaves to port 50000. Who needs a rule for it?

Try it

This row has a new custom gate. It denies everything. Let shoppers in on 443, and let their replies out.

Set the row gate's list. Right visitors in, their replies out.

Visitors

  • Shopper on Windowsshould get inTCP 443 from 198.51.100.20Its replies go back to ports 49152–65535.
  • Shopper on Linuxshould get inTCP 443 from 203.0.113.50Its replies go back to ports 32768–61000.
  • Port scannerkeep outTCP 3389 from 192.0.2.66Its replies go back to ports 32768–61000.

Row gate · network ACL (the subnet)

Lowest number first. The first rule that fits decides. It remembers nothing, so replies need an Out rule.

In

RuleTrafficFromAllow/Deny
*All traffic0.0.0.0/0DENY

Out

RuleTrafficToAllow/Deny
*All traffic0.0.0.0/0DENY

Unit door · security group (the server)

Allow rules only. It remembers who came in, so replies always go out.

In

  • TCP 443 · from 0.0.0.0/0

Out: all traffic (a new group starts this way).

Check

The CLI adds a door rule too. This is the official example’s answer, cut short. Tap the line that says who may come in.

Tap the line that says who may come in.

0 of 1 found

Check

Door guard or row gate? Sort each fact.

Drag a card into a box. Or tap the card, then tap the box.

      You did it!

      You can now set both guards, so only the right visitors get in.

      Go deeper (optional)

      The default network ACL allows everything, so most people only tune security groups. A new security group lets nothing in and everything out. Instead of SSH, try Session Manager: it needs no open inbound port at all.