AWS Security Groups and Cloud Security Group Objects

Relationship between AWS Security Groups and Cloud Security Group Objects

A security group in the Amazon Web Services (AWS) console is a collection of rules that act as a virtual firewall for the instances and other entities contained in the security group. A security group can be associated with other security groups, ports, port ranges, IPV4 or IPV6 addresses, subnets, and load balancers.

When you onboard an AWS VPC to Security Cloud Control, AWS security groups are translated into Security Cloud Controlcloud security group objects. The AWS console does not support rules that contain more than one source, destination, or port/port range. If you define more than one source, destination, or port/port range within a single rule in Security Cloud Control and deploy, Security Cloud Control translates the rule into separate rules before deploying it to the AWS VPC. For example, if you create an outbound rule in Security Cloud Control that allows traffic from one security group, "A" to another security group "B" and an IPv6 address, Security Cloud Control deploys this to AWS as two separate rules: (1) to allow outbound traffic from security group object A to security group object B and (2) to allow outbound traffic from security group object A to the IPv6 address.

Note that security groups are associated with individual AWS VPCs and cannot be shared across device types. That means that you cannot share a cloud security group object with an ASA, FTD, IOS, SSH, or Meraki device.