4.2 Firewalls, security groups and network rules
You can open exactly one port to exactly one source and prove nothing else is open.
Before:03. Storage & DatabasesUnlocks:05. Identity, Security & Compliance
The same thing, three names
One idea, sold under a different brand by each provider. Learn it once and you can read any job advertisement.
- On AWS
- Security Groups + NACLs
- On Azure
- Network Security Groups
- On Google Cloud
- VPC firewall rules
The working unit of cloud network security is the rule that opens exactly one port to exactly one source, and this topic builds fluency in writing and reading them: stateful against stateless rules, least-privilege ingress, and egress control as the defence against data walking out. It follows virtual networks because rules attach to that structure. The habit it names and fights is 0.0.0.0/0 — opening a port to the whole internet because it made a tutorial work, then forgetting the rule exists.
Work through these
Stateful vs stateless rules
A stateful rule remembers a connection it allowed and lets the reply back automatically; a stateless one needs both directions written. Mixing the two up produces traffic that mysteriously works one way only.
Least-privilege ingress; the 0.0.0.0/0 habit and its consequences
Opening a port to the entire internet because it is quicker than finding the right source range is the habit this item exists to break. The consequence is that your machine is found by scanners within minutes.
Egress control and why it matters for exfiltration
Controlling what leaves is less common and matters because it is how data gets out after a compromise. Outbound restrictions are the difference between an intrusion and a data loss.
Reading effective rules when several layers overlap
When several layers of rules overlap, what is actually permitted is their combination, which is rarely what any single layer says. Being able to read the effective result is the practical skill.
Sign in to keep your progress.
Free resources
We haven't checked most of these for screen reader use yet.
Links last checked 29 Aug 2026.
Stuck here?
Ask a mentor. A real person answers, and they can see exactly which topic you're on. Usually within a couple of working days.
Checking your session…
Topics shown in module order.