Understanding Security Groups

While Security Lists are typically applied at the subnet level to provide broad firewall rules for multiple resources, Security Groups offer a more fine-grained, instance-specific approach to traffic filtering.

What is a Security Group?

A Security Group acts as a virtual firewall for one or more specific Compute Instances. Unlike a Security List that applies to everything in a subnet, a Security Group is explicitly attached to the virtual network interfaces (vNICs) of individual instances.

This allows you to create highly specific architectures. For example:

• A web-servers Security Group that allows inbound port 80 and 443.
• A database-servers Security Group that only allows inbound port 3306 from instances that belong to the web-servers Security Group.

Creating a Security Group

1. Navigate to Networking > Security Groups in the LYNIO Console.
2. Click Create Security Group.
3. Provide a name (e.g., web-nodes) and a description.
4. Select the VPC this group belongs to.

Adding Rules

Security Group rules work similarly to Security Lists, but with added flexibility:

• Ingress Rules: Define what incoming traffic is allowed.
• Egress Rules: Define what outgoing traffic is allowed.

When adding a rule, you can specify standard CIDR blocks (like 0.0.0.0/0), but you can also specify another Security Group as the source or destination. This is incredibly powerful for zero-trust architectures.

Attaching to an Instance

Once your group is created and rules are defined:

1. Go to Compute > Instances.
2. Select your instance and navigate to the Networking tab.
3. Click Manage Security Groups.
4. Select your newly created Security Group and apply the changes.

The rules take effect immediately without requiring an instance reboot.