Security Group and Network ACL (NACL) are both firewalls in AWS, but they protect different parts of your network.

A Security Group acts like a firewall attached directly to an EC2 instance (or ENI). It controls which traffic can enter or leave that specific instance. Security Groups are stateful, meaning if you allow an inbound request, the return traffic is automatically allowed even if there is no explicit outbound rule. Security Groups support only allow rules; you cannot create a deny rule.

A Network ACL (NACL) acts like a firewall at the subnet level. Every resource inside that subnet is affected by the NACL rules. NACLs are stateless, meaning you must explicitly allow both the incoming request and the outgoing response traffic. NACLs support both allow and deny rules.