澄清安全组和内部前缀列表之间的区别最好，并对此进行简要说明
想知道安全组与内部前缀列表之间的区别，并且知道哪种是不允许外部流量进入云的最佳选择？
Wanted to know the difference between security groups and internal prefix-list and to know which would be best for not allowing the external traffic to enter the cloud?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
A 安全组是亚马逊VPC中单个资源的防火墙。
例如，您可以将一个安全组添加到Amazon EC2实例中，该实例仅允许在端口80和443（HTTP和HTTPS）上访问。到达实例之前，任何进入其他端口的请求都将被阻止。然后，您可以添加另一个允许访问端口22（SSH）的规则，但仅从IP地址访问。您可以连接，但是任何其他IP地址的请求都将被阻止。
可以为入站连接（进入实例）以及出站连接（请求离开实例）的规则。请求是状态的，这意味着始终允许朝另一个方向响应一个方向的请求。例如，如果有一个允许端口80的入站规则，则实例将能够响应HTTP请求，而无需特别允许响应的出站规则。
安全组也可以互相参考。例如：
是，数据库安全组专门指实例安全组。与EC2安全组关联的任何实例都可以访问数据库。
在安全组中定义规则时，您指定了定义规则允许的IP地址的 cidr 。例如，
0.0.0.0/0表示整个Internet，而1.2.3.0/24表示所有以1.2.2.3.x 。前缀列表只是预定义的CIDR列表。它们通过允许从特定前缀列表访问而不是必须使用一个CIDR来定义多个规则来更容易定义规则。因此，前缀列表可以由安全组使用。
A Security Group is a firewall on an individual resource in an Amazon VPC.
For example, you could add a Security Group to an Amazon EC2 instance that only permits access on port 80 and 443 (HTTP and HTTPS). Any requests going to other ports would be blocked before reaching the instance. You could then add another rule that permits access to port 22 (SSH) but only from your IP address. You could connect, but requests from any other IP address would be blocked.
Rules can be configured for Inbound connections (going into the instance) and also for Outbound connections (requests leaving the instance). Requests are stateful, meaning that a request in one direction will always be permitted a response in the other direction. For example, if there is an Inbound rule permitting port 80, then the instance will be able to respond to an HTTP request without needing an Outbound rule that specifically permits the response.
Security Groups can also refer to each other. For example:
That is, the database security group specifically refers to the instance security group. Any instance associated with the EC2 security group would be allowed to access the database.
When defining rules in a Security Group, you specify a CIDR that defines the IP address(es) that are permitted by the rule. For example,
0.0.0.0/0means the entire Internet, while1.2.3.0/24means all IP addresses starting with1.2.3.x.Prefix Lists are simply a pre-defined list of CIDRs. They make it easier to define rules by permitting access from a specific Prefix List rather than having to define multiple rules with one CIDR per rule. So, prefix lists can be used by security group.