Account for stateful return traffic when reviewing AWS security groups

Separate a permitted response from a newly initiated connection.

Source facts

AWS security groups are stateful. Responses to allowed outbound requests can return regardless of inbound rules, and responses to allowed inbound traffic can leave regardless of outbound rules. Groups control traffic for associated resources, while AWS documents specific traffic classes that security groups do not filter.

Source: AWS Documentation.

Applicability

This concerns security-group rule interpretation, rather than the stateless behavior of subnet network ACLs.

DSE recommendation

DSE recommends documenting the initiator, protocol and destination for each required connection. Review new outbound access separately from response traffic so unnecessary reverse-direction rules are not added during troubleshooting. Identify all groups attached to the affected resource and the actual route. Keep management access limited to approved origins and assign rule ownership. Record the service requirement beside the rule so later reviewers can remove exceptions without guessing why a broad range was opened. Write down whether the troubleshooting packet is a reply or a new connection before approving a new rule. Keep a small connection matrix with the application owner, and ask reviewers to explain every newly allowed initiator instead of opening both directions by habit.

Verification

Proposed verification: establish an approved connection between test endpoints, observe its response behavior and attempt a separate unapproved initiation in the reverse direction. Inspect all associated groups and other network controls before attributing a result to one rule. Preserve the source and destination context.

Official reference

AWS Documentation. Reviewed October 20, 2026.