Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Currently I am using only an AWS security group for one of my EC2 instances but have given some thought to adding a firewall to that stack as well. I'd be looking at using either iptables, or possibly migrating the entire system to ubuntu (not related to this problem) so might just end up using ufw.

If I leave this machine protected using only the security group, am I missing out on some protection? I haven't been able to get a good feel for its level of protection when compared to a traditional *nix software firewall.

share|improve this question
up vote 2 down vote accepted

If there's ever a bug or exploit in AWS's security groups implementation, you might wind up vulnerable where having iptables or something similar would've protected you.

share|improve this answer
Right. This was my guess. So really iptables/similar just have a better track record, there's nothing inherently different/flawed with AWS's 'firewall' (i.e. security groups)? – John Carter Aug 27 '12 at 19:47
I've never heard of an issue with the AWS security groups failing thus far, and as it runs at a higher level than the instance it's theoretically better. That said, "defense in depth" is a good idea, and you're rarely going to be hurt by being over-cautious by running both. – ceejayoz Aug 27 '12 at 19:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.