• Scope: Security Groups operate at the instance level and must be assigned explicitly to the instance. On the other hand, Network ACLs operate at the subnet level and apply automatically to all instances deployed in the associated subnet.
• State: Security Groups are stateful, meaning if you allow incoming traffic on a certain port, the outgoing traffic on that port will be automatically allowed. Network ACLs are stateless, so return traffic must be explicitly allowed by the rules.
• Rule Type: Security Groups support allow rules only, and everything else is implicitly denied. You cannot deny a certain IP address from establishing a connection. Network ACLs, however, support both allow and deny rules.
• Rule Process Order: Security Groups evaluate all rules before deciding whether to allow traffic. Network ACLs evaluate rules in order, starting with the lowest numbered rule.
• Occurrence: An instance can have multiple Security Groups, but a subnet can have only one NACL.
• Rule Destination: Security Group rules allow CIDR, IP, and Security Group as destinations. Network ACL rules only allow CIDR as a destination.
• Defense Order: For outbound/egress traffic, Security Group is the first layer of defense, whereas Network ACL is the second layer of defense. For inbound/ingress traffic, Network ACL is the first layer of defense, whereas the Security Group is the second layer of defense.