Security groups, the stateful firewall

A security group is the firewall wrapped around every instance, deny inbound by default and stateful by design. Understand how ingress rules open ports, why source scoping is the whole game, and what stateful tracking buys you that a stateless network ACL does not.