Connect with the author on X and LinkedIn for Cloud Architect tips.

This short guide explains one important characteristic of AWS Network ACLs and Security Groups that many beginners miss.

Often you won't run into a situation that forces you to learn the difference between stateless and stateful.

You just tweak inbound/outbound rules until traffic works, and that’s fine. Because of that, many beginners never notice the underlying behavior until they hit a tricky networking issue.

Let's start.

Video version:

Security Groups are Stateful

What does stateful mean here?

It means a Security Group remembers the connection in memory.

When you attach a Security Group to an EC2 instance, you usually configure both inbound and outbound rules:

• Inbound rule: allows traffic from a specific source (e.g., a user’s IP).

• Outbound rule: allows the EC2 instance to send responses back.

Example: Suppose a user with IP 10.0.1.12 wants to access your EC2 instance on port 80. The inbound rule must allow this IP.

Normally, you might think you also need an outbound rule for the response, which is true for other types of connections.

But here’s the twist: Security Groups are stateful, so once an inbound rule is allowed, the outbound response traffic is automatically allowed even if no outbound rule is defined, as shown below.

That’s why the user will still get the response, and your application works as expected.

The same applies in the other direction, but one side must be accepted first for it to work.

Network ACLs are Stateless

What does stateless mean here?

It means a Network ACL (NACL) does not remember connections. Every packet is checked individually, whether it’s a request or a response.

You must explicitly configure both inbound and outbound rules to allow traffic from a specific IP and to send the response back.

Unlike Security Groups, if either rule is missing, the request will fail.

Thanks for reading.

– Alon