Security groups are stateful, allow-only firewalls on network interfaces. Network ACLs are stateless, ordered allow/deny lists on subnets. Most designs use security groups only and leave the default NACL, which allows everything.

	Security group	Network ACL
Attached to	Network interfaces (instances, tasks, load balancers, endpoints, Lambda ENIs)	Subnets; each subnet has exactly one
Rules	Allow only	Allow and deny
Evaluation	All rules of all attached groups, combined	In rule-number order (1–32766), first match wins
State	Stateful: responses are allowed automatically	Stateless: responses need their own rule (ephemeral ports 1024–65535)
Applies	To traffic at the interface	When traffic enters or leaves the subnet, not within it
Default	New group: no inbound, all outbound	Default NACL: allow all. Custom NACL: see note below
Charge	None	None

Security group rules

Source or destination can be a single IPv4 address (/32) or IPv6 address (/128), a CIDR range, a prefix list (pl-…), or a security group (sg-…).
Referencing a group admits traffic from the private IPs of the members' network interfaces. Inbound references work in the same VPC, across peering, or across a transit gateway. Outbound references work in the same VPC or across peering only. The referenced group's own rules are not copied.
Middleboxes: when routes send traffic through an appliance, a group reference does not match. Reference the other side's IP or subnet CIDR instead.
Stale rules: a reference to a group in a peer or shared VPC becomes stale when that group or the peering is deleted. Delete stale rules like any other.
Changes apply at once to every attached resource. Whether an existing connection is affected depends on connection tracking (UNVERIFIED details; see the EC2 connection-tracking page).
Authorizing or revoking a rule that references a group checks only that the group exists. IAM conditions on the referenced group have no effect, and the other account sees no CloudTrail event.
Descriptions are up to 255 characters.

How rules count

Rule references	Counts as
A CIDR	1 rule
A security group	1 rule, whatever its size
A customer-managed prefix list	Its maximum entries
An AWS-managed prefix list (for example CloudFront's)	Its weight

The rules-per-group quota applies separately to inbound and outbound rules, and to IPv4 and IPv6 rules. Rules per group × groups per network interface ≤ 1,000 (fixed). Both factors are adjustable quotas; read their current values in Service Quotas.

Network ACL rules

Numbered 1–32766. Leave gaps (10, 20, …) so you can insert rules later.
A rule matches protocol, port range and CIDR, then allows or denies.
Because NACLs are stateless, a web subnet that admits 443 inbound must also allow outbound 1024–65535 to clients. A subnet calling out needs inbound 1024–65535 for the replies.
Load balancer subnets and target subnets need the health-check port one way and the ephemeral ports back (reference/elb/errors.md).
The rules-per-NACL quota can be raised to at most 40 inbound and 40 outbound rules, at a possible cost to network performance.
A custom NACL denies all traffic until you add rules (UNVERIFIED in the collected sources: the page links to the custom-NACL subpage without stating it).

What neither can block or filter

DNS to the Route 53 Resolver (the VPC+2 address, AmazonProvidedDNS). Use Route 53 Resolver DNS Firewall instead.
The instance metadata service (control it with IMDS options: reference/ec2/instance-metadata-and-roles.md), and ECS task metadata endpoints.
Amazon DHCP, Amazon Time Sync, Windows license activation, and the reserved router addresses.

Each network interface can send 1,024 packets per second to the Route 53 Resolver (fixed). High DNS volume from one instance is throttled no matter what the firewall rules say.

Diagnosing

Reachability Analyzer names the layer: ENI_SG_RULES_MISMATCH or SG_HAS_NO_RULES for a security group, SUBNET_ACL_RESTRICTION for a NACL (reference/vpc/errors.md).