Apa iku security groups lan carane kontrol akses?

Question

Accepted Answer

**Security groups** minangka virtual firewalls sing kontrol **traffic inbound lan outbound** menyang AWS resources (kaya EC2 instances) — ngedefinisikake port, protocols, lan sources endi wae sing dibolehake. Iku fundamental kanggo AWS network security.

## Apa sing dilakoni security groups

```text
A SECURITY GROUP is a virtual firewall attached to resources (EC2, RDS, etc.):
  → INBOUND rules — what traffic can REACH the resource (port, protocol, source)
  → OUTBOUND rules — what traffic the resource can SEND OUT
  → only ALLOW rules (no explicit deny); everything not allowed is DENIED by default
  → STATEFUL — if inbound is allowed, the response is automatically allowed back
```

## Contoh rules

```text
Inbound rules for a web server:
  Allow TCP 443 (HTTPS) from 0.0.0.0/0   → anyone can reach HTTPS
  Allow TCP 80  (HTTP)  from 0.0.0.0/0   → anyone can reach HTTP
  Allow TCP 22  (SSH)   from <your IP>/32 → ONLY your IP can SSH (not the whole world!)
→ everything else is blocked (default deny)
```

## Pola kuat: referensi security groups liyane

```text
Rules can allow traffic from ANOTHER security group (not just IPs):
  → DB security group: allow port 5432 FROM the app-server security group
  → means: only the app servers (whatever their IPs) can reach the database
→ Tiered security: web SG → app SG → db SG (each layer only accepts from the previous)
```

## Security groups vs NACLs

```text
SECURITY GROUPS → at the RESOURCE level; stateful; allow-only; the primary tool
NETWORK ACLs (NACLs) → at the SUBNET level; stateless; allow AND deny rules;
  a secondary, coarser layer
→ Use security groups as the main control; NACLs for subnet-wide rules.
```

## Mulane penting

Paham security groups iku penting amarga iku fundamental kanggo **AWS network security** — kontrol traffic apa wae sing bisa tekan resources mu — dadi essential practical knowledge kanggo ndeploy resources kanthi aman.

Security groups dadi **virtual firewalls** sing ngedefinisikake traffic endi wae (ports, protocols, sources) sing dibolehake menyang lan saka resources, kanthi secure-by-default model (mung allow rules; kabeh sing ora explicitly allowed ditolak) lan stateful behavior (responses kanggo allowed traffic automatic diperbolehake).

Paham carane configure rules kanthi bener iku essential kanggo security — contone, allow HTTP/HTTPS saka mana wae kanggo web server tapi **restrict SSH access menyang specific IPs** (ora sakabèhe internet — practices penting lan umum, amarga expose SSH ke dunia iku security risk).

Pola **kuat referensi security groups liyane** (allow database's security group terima traffic cuma saka app servers' security group, sebaran IPs apa wae) ngaktifake **tiered security architectures** sing bersih (web → app → database, saben layer cuma nerima traffic saka sebeluse) — approach best-practice sing batasi exposure lan ngetutake least privilege ing level network.

Paham **security groups vs NACLs** (security groups ing level resource minangka primary, stateful, allow-only tool; NACLs ing level subnet minangka coarser secondary layer, stateless) njelasake layered network security model.

Amarga kontrol network access menyang resources iku fundamental kanggo AWS security (misconfigured access — kaya ports sing kebuka utawa SSH/databases sing bisa diakses saka mana wae — nyebabake real vulnerabilities), lan amarga security groups minangka primary mechanism kanggo iki (kanthi security-group-referencing pattern ngaktifake secure tiered architectures), paham security groups iku essential, practically-important AWS knowledge kanggo ndeploy resources kanthi aman — core security topic endi proper configuration (restrict access kanthi tepat, nggunakake tiered security-group references) langsung nglindungi network-level exposures sing nyebabake breaches.