Question

A company runs a three-tier application in a VPC. The database tier EC2 instances are in private subnets, and the application tier must connect to them on TCP 5432. A security engineer configures the database instances' security group to allow inbound TCP 5432 only from the application tier's security group. However, the engineer forgets to add any outbound rule allowing return traffic to the application tier. During testing, application-to-database connections succeed normally. Why do the connections still work despite the missing explicit outbound allow rule?

Accepted Answer

Security groups are stateful, so return traffic for an allowed inbound connection is automatically permitted regardless of outbound rules.

Answer

The default network ACL on the subnet allows all outbound traffic, which overrides the security group's missing rule.

Answer

Security groups implicitly allow all outbound traffic because the default outbound rule permits all traffic, which was left in place.

Answer

The application tier security group's outbound rule to the database opens the return path automatically.