Security groups vs network ACLs, explained

Security groups vs network ACLs in AWS: where each one sits, how their rules are evaluated, and why stateless ACLs need rules for replies.