Question

A SysOps administrator deploys an EC2 web server in a public subnet. The security group allows inbound TCP 443 from 0.0.0.0/0 but has NO outbound rules configured (all outbound rules were removed). The associated network ACL uses the default allow-all rules. Users report they cannot receive responses when connecting to the web server over HTTPS. What is the MOST likely cause and the correct fix?

Accepted Answer

Security groups are stateful, so return traffic is automatically allowed regardless of outbound rules; the real problem must be the route table missing an internet gateway route.

Answer

Security groups are stateful, so removing all outbound rules blocks the return traffic; add an outbound rule allowing the response traffic (or restore the default allow-all outbound rule).

Answer

The network ACL is blocking ephemeral return ports; add an inbound NACL rule for ports 1024-65535.

Answer

The inbound rule must specify the client's ephemeral source ports instead of 0.0.0.0/0; change the inbound rule to allow TCP 1024-65535.