Operates at the instance level (first layer of defense) & apply to network interfaces, not to IP addresses. Supports allow rules only. Is stateful: Return traffic is automatically allowed, regardless of any rules. We evaluate all rules before deciding whether to allow traffic. Applies to an instance only if someone specifies the security group when launching the instance, or associates the SG with the instance later on.