Security groups nima ne kuma ta yaya suke sarrafa shiga?

**Security groups** su ne virtual firewalls da ke sarrafa **zazzagewa da fitowa** na traffic zuwa AWS albarkatun (kamar EC2 instances) — suna bayyana wanne ports, protocols, da sources suke ba da izini. Suna da mahimmanci sosai ga AWS network security.

Question

Security groups nima ne kuma ta yaya suke sarrafa shiga?

**Security groups** su ne virtual firewalls da ke sarrafa **zazzagewa da fitowa** na traffic zuwa AWS albarkatun (kamar EC2 instances) — suna bayyana wanne ports, protocols, da sources suke ba da izini. Suna da mahimmanci sosai ga AWS network security.

Accepted Answer

## Abubuwan da security groups ke yi

```text
A SECURITY GROUP is a virtual firewall attached to resources (EC2, RDS, etc.):
  → INBOUND rules — what traffic can REACH the resource (port, protocol, source)
  → OUTBOUND rules — what traffic the resource can SEND OUT
  → only ALLOW rules (no explicit deny); everything not allowed is DENIED by default
  → STATEFUL — if inbound is allowed, the response is automatically allowed back
```

## Misalan tsari

```text
Inbound rules for a web server:
  Allow TCP 443 (HTTPS) from 0.0.0.0/0   → anyone can reach HTTPS
  Allow TCP 80  (HTTP)  from 0.0.0.0/0   → anyone can reach HTTP
  Allow TCP 22  (SSH)   from <your IP>/32 → ONLY your IP can SSH (not the whole world!)
→ everything else is blocked (default deny)
```

## Ƙarfin tsari: tuna wa sauran security groups

```text
Rules can allow traffic from ANOTHER security group (not just IPs):
  → DB security group: allow port 5432 FROM the app-server security group
  → means: only the app servers (whatever their IPs) can reach the database
→ Tiered security: web SG → app SG → db SG (each layer only accepts from the previous)
```

## Security groups da NACLs

```text
SECURITY GROUPS → at the RESOURCE level; stateful; allow-only; the primary tool
NETWORK ACLs (NACLs) → at the SUBNET level; stateless; allow AND deny rules;
  a secondary, coarser layer
→ Use security groups as the main control; NACLs for subnet-wide rules.
```

## Me ya sa hakan ya mahimma

Ganewa da security groups yana da mahimmanci domin suna mahimmancin **AWS network security** — sarrafa wanne traffic zai iya kawo ga albarkatunka — saboda haka ilimi mai amfani da zahiri shine dole.

Security groups suna aiki azaman **virtual firewalls** da ke bayyana wanne traffic (ports, protocols, sources) suke ba da izini zuwa da daga albarkatun, tare da ƙarfin ajiye (izini kawai; komai ba a cikakka ba ana ya ba da izini ana ƙokewa) da halayen da suke da hali (amsa ga traffic da aka ba da izini an ba su izini ta kansu).

Ganewa da yaya za a shirya tsarau daidai yana da mahimmanci ga tsaro — misali, ba da izini HTTP/HTTPS daga ko'ina don server na jiya amma **ƙunshi SSH access ga musamman IPs** (ba gida gida duka — aikin da ya kasance mahimmanci, tun da bubugo SSH ga duniya shuni ne kasada).

**Karfin tsari na tuna wa sauran security groups** (ba da izini ga database's security group don karba traffic kawai daga app servers' security group, ko da yaushe IPs nasu) yana ba da dama don shirya clean **tiered security architectures** (web → app → database, kowane tudu ya karba traffic kawai daga da gida) — ingantaccen ƙarfin da ke damewa da aiki minkaɗi na karkata a network level.

Ganewa da **security groups da NACLs** (security groups a mataki na albarkatun azaman babbar, halayen da suke da hali, izini-kawai tool; NACLs a mataki na subnet azaman coarser, halayen da ba sa da hali na biyu) yana farawa da ƙollon network security model na ƙalamin.

Tun da sarrafa network access zuwa albarkatun shine mahimmancin AWS security (tsaro da ba a shirya daidai ba — kamar bubuwan budewa ko duniya-accessible SSH/databases — yana haifar da kasada na zahiri), kuma tun da security groups sune babbar instrument don haka (tare da security-group-referencing pattern yana ba da dama don secure tiered architectures), ganewa da security groups shine mahimmancin, aikin mahimmanci AWS ilimi don bubugo albarkatun da tsaro — babbar jiya game da tsaro inda shirya daidai (ƙunshi access daidai, amfani da tiered security-group references) kai tsaye sarrafa network-level exposures da ke haifar da kasada.