AWS Administration Cookbook

Differences from traditional firewalls

• Security groups can't be used to explicitly block traffic. Only rules of a permissive kind can be added; deny style rules are not supported. Essentially, all inbound traffic is denied unless you explicitly allow it.
• Your rules also may not refer to source ports; only destination ports are supported.
• When security groups are created, they will contain a rule which allows all outbound connections. If you remove this rule, new outbound connections will be dropped. It's a common pattern to leave this rule in place and filter all your traffic using inbound rules only.
• If you do replace the default outbound rule, it's important to note that only new outbound connections will be filtered. Any outbound traffic ...