Security Group vs Network ACL (AWS)

What this card says

What each one is

Security group: a firewall on one server’s network card. It has allow rules only.
Network ACL (NACL): a firewall on a whole subnet (a group of servers). It can allow and deny.

Stateful vs stateless

Security group = stateful. If a request is allowed in, the reply goes out by itself.
NACL = stateless. It checks traffic both ways, so you need rules for the reply too.

Example: a web server

Security group: allow port 443 (HTTPS) from anywhere, and port 22 (SSH) only from your IP /32.
NACL: a rough guard for the whole subnet, like blocking one bad IP range.

Use when

Start with tight security groups. They control each app.
Add NACLs as an extra, broad guard at the subnet level.