AWS has two layers of network security. Knowing which one to use is the mark of a Senior Architect.
Security Groups act at the Instance Level (like a firewall for your PC). They are Stateful—if you allow traffic in on port 80, the response is automatically allowed out. Most of your daily security work happens here.
NACLs act at the Subnet Level. They are Stateless—you must explicitly allow both Inbound and Outbound traffic. NACLs are your 'Last Line of Defense' used to block specific malicious IP addresses at the border.
| Feature | Security Group | Network ACL |
|---|---|---|
| Target | Instance/ENI | Subnet |
| Type | Stateful | Stateless |
| Rule Order | All evaluated | Processed in order |
Q: "How many Security Groups should I have?"
Architect Answer: "Use a **Security Group Chain**. Create one SG for your Load Balancer (allow 80/443). Create another SG for your .NET API that ONLY allows traffic from the 'Load Balancer SG'. This ensures no one can bypass your LB and talk to your API directly."