Issue
I have a single active EC2 instance making requests via a Python script. There is a security group attached to this particular instance with SSH, HTTP, and HTTPS communication with ONLY sources and traffic allowed for my IP address.
For each request made via the Python script, there is a successful response received that I can then analyze. This is confusing and unexpected as this response should be blocked by my security group as it is generated and sent from another IP address via HTTP or HTTPS protocol. Why are these responses being successfully received by instance and code?
EDIT 1:
Image 1:
Image 2:
Solution
Security groups are stateful. Response to an http request is sent in the same tcp connection, so it will not be blocked, because your ec2 instance initiated the connection (see the tcp connection lifecycle).
Should another component try to connect (initiate a connection) to your instance from outside of your allowed IPs, it would be blocked.
Answered By - Gabor Lengyel
