Security groups ni nini na zinadhibitije ufikiaji?

Question

Accepted Answer

**Security groups** ni virtual firewalls zinazodhibiti **trafiki inayoingia na inayotoka** kwa rasilimali za AWS (kama EC2 instances) — kufafanua ports, protocols, na sources zinazoruhusiwa. Ni jambo la msingi kwa usalama wa mtandao wa AWS.

## Security groups hufanya nini

```text
A SECURITY GROUP is a virtual firewall attached to resources (EC2, RDS, etc.):
  → INBOUND rules — what traffic can REACH the resource (port, protocol, source)
  → OUTBOUND rules — what traffic the resource can SEND OUT
  → only ALLOW rules (no explicit deny); everything not allowed is DENIED by default
  → STATEFUL — if inbound is allowed, the response is automatically allowed back
```

## Mfano wa rules

```text
Inbound rules for a web server:
  Allow TCP 443 (HTTPS) from 0.0.0.0/0   → anyone can reach HTTPS
  Allow TCP 80  (HTTP)  from 0.0.0.0/0   → anyone can reach HTTP
  Allow TCP 22  (SSH)   from <your IP>/32 → ONLY your IP can SSH (not the whole world!)
→ everything else is blocked (default deny)
```

## Mfumo wenye nguvu: kurejelea security groups nyingine

```text
Rules can allow traffic from ANOTHER security group (not just IPs):
  → DB security group: allow port 5432 FROM the app-server security group
  → means: only the app servers (whatever their IPs) can reach the database
→ Tiered security: web SG → app SG → db SG (each layer only accepts from the previous)
```

## Security groups vs NACLs

```text
SECURITY GROUPS → at the RESOURCE level; stateful; allow-only; the primary tool
NETWORK ACLs (NACLs) → at the SUBNET level; stateless; allow AND deny rules;
  a secondary, coarser layer
→ Use security groups as the main control; NACLs for subnet-wide rules.
```

## Kwa nini ni muhimu

Kuelewa security groups ni muhimu kwa sababu ni jambo la msingi kwa **usalama wa mtandao wa AWS** — kudhibiti trafiki gani inaweza kufikia rasilimali zako — kwa hivyo ni maarifa muhimu ya vitendo kwa kutuma rasilimali kwa usalama.

Security groups hufanya kazi kama **virtual firewalls** zinazofafanua trafiki gani (ports, protocols, sources) inaruhusiwa kwenda na kutoka kwa rasilimali, na mfumo wa secure-by-default (allow rules tu; kila kisichoruhusiwa wazi hukataliwa) na tabia ya stateful (majibu kwa trafiki iliyoruhusiwa huruhusiwa kiotomatiki).

Kuelewa jinsi ya kusanidi rules kwa usahihi ni muhimu kwa usalama — kwa mfano, kuruhusu HTTP/HTTPS kutoka popote kwa web server lakini **kuzuia ufikiaji wa SSH kwa IPs maalum** (si intaneti nzima — mbinu ya kawaida, muhimu, kwani kufichua SSH kwa ulimwengu ni hatari ya usalama).

**Mfumo wenye nguvu wa kurejelea security groups nyingine** (kuruhusu security group ya hifadhidata kukubali trafiki tu kutoka security group ya app servers, bila kujali IPs zao) huwezesha **usanifu safi wa tiered security** (web → app → database, kila safu ikikubali trafiki tu kutoka iliyotangulia) — mbinu bora inayopunguza ufichuaji na kufuata least privilege katika kiwango cha mtandao.

Kuelewa **security groups vs NACLs** (security groups katika kiwango cha rasilimali kama zana ya msingi, stateful, allow-only; NACLs katika kiwango cha subnet kama safu ya pili, ya jumla zaidi, stateless) huweka wazi mfumo wa layered network security.

Kwa kuwa kudhibiti ufikiaji wa mtandao kwa rasilimali ni jambo la msingi kwa usalama wa AWS (ufikiaji uliosanidiwa vibaya — kama ports zilizo wazi mno au SSH/hifadhidata zinazofikika na ulimwengu — husababisha udhaifu halisi), na kwa kuwa security groups ni mbinu ya msingi ya hili (na mfumo wa kurejelea security-group ukiwezesha usanifu wa tiered ulio salama), kuelewa security groups ni maarifa muhimu na muhimu kivitendo ya AWS kwa kutuma rasilimali kwa usalama — mada ya msingi ya usalama ambapo usanidi sahihi (kuzuia ufikiaji ipasavyo, kutumia tiered security-group references) huzuia moja kwa moja ufichuaji wa kiwango cha mtandao unaopelekea uvunjaji.