34

In the AWS documentation it says

Security groups are stateful — if you send a request from your instance, the response traffic for that request is allowed to flow in regardless of inbound security group rules.

I don't understand how this behavior is regarded as stateful? How would a stateless situation proceed?

I suppose that the response traffic would depend on some type of rule, but how does this relate to state?

Thanks

1
  • 2
    if you send a request from your instance this action changes the state of the access logic. Behavior after this action is different from behavior before it. They are saying the incoming traffic might have been blocked without this. For example if some other external source like an SQS queue had triggered the incoming traffic.
    – Dave S
    Dec 4, 2018 at 23:35

2 Answers 2

102

I went to a movie with my son. During the film, he needed to go to the restroom.

The staff member at the door let him leave the theater and allowed him to re-enter afterwards. This is an example of a stateful request -- he went out and was allowed back in. However, somebody who simply tried to get into the theater would be rejected.

Similarly, your computer at home is connected to a router. The router protects it from the evils of the Internet. Traffic can't come through your router to your computer. However, if you make a request to go to a website, that request goes out of your router and the response is allowed back in because it is stateful. That is, the router remembers that you made the request to that website and it permits the response to come back to your computer.

4
  • 3
    nice examples used Sep 15, 2019 at 13:39
  • 1
    Great Example! This example clears all the doubts. Thank You ! Jun 18, 2020 at 12:12
  • 1
    "I went to a movie with my son". That is where it got interesting.
    – Jasser
    Jun 20, 2020 at 7:04
  • 1
    Such great example! I shared it with my entire team.
    – krish___na
    Jan 5 at 5:38
7

It simply means if you allow say outbound rule on particular port protocol ip address it will allow to get back. So whatever coms in comes out.

You can compare this with NACL as they are stateless so you need to specify inbound and outbound rules in order to allow requested traffic flow.

1
  • 1
    Excellent point in making a crucial difference between how SGs and NACLs work.
    – kaskelotti
    Mar 8, 2022 at 13:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.