Are AWS security groups free? Yes, and what actually costs money

Quick answer

Yes, AWS security groups are completely free: there is no charge to create, modify, or attach them, and no limit-based fee for the rules within reasonable defaults. Security groups are a built-in stateful firewall feature of the VPC. What does cost money is the infrastructure they protect (EC2 instances, load balancers, NAT gateways) and the more advanced network security services that are not security groups: AWS WAF, AWS Network Firewall, and AWS Shield Advanced all carry their own charges. So the firewall rules are free; the traffic filtering appliances and protected resources are not.

Security groups are one of the most-used AWS features, and a common question is whether they add to the bill. The short answer is no: security groups are free. But it helps to know exactly what is free (the security group itself) and what is not (the resources it protects and the heavier network security services people sometimes confuse with it).

Security groups are free

A security group is a stateful virtual firewall attached to resources like EC2 instances, load balancers, and RDS databases. Creating security groups, adding inbound and outbound rules, and attaching them to resources all carry no charge. They are a core part of the VPC, and like the VPC itself, the basic construct is free. You can run a well-segmented network with many security groups and pay nothing for the groups themselves.

What the free firewall protects does cost money

Free	Not free
Security groups and rules	The EC2 instances they protect
Network ACLs	Load balancers and their processing
VPC, route tables, subnets	NAT gateways and data processed

Security groups are free, but the things they secure are not: the EC2 instances, the load balancers, the NAT gateways, and the data transfer all bill normally. So a security group does not add cost, but wrapping it around expensive resources does not make those resources cheaper either. The firewall is free; the protected infrastructure is the bill.

Where people confuse security groups with paid services

The confusion usually comes from AWS's paid network security services, which are not security groups. AWS WAF (web application firewall) charges per web ACL, per rule, and per million requests inspected. AWS Network Firewall charges an hourly endpoint fee plus data processed. AWS Shield Advanced has a monthly subscription. These are separate, more capable filtering services with real costs, distinct from the free, built-in security groups and network ACLs. If your bill shows network security charges, it is one of these, not the security groups.

The takeaway

Use security groups freely; they cost nothing and are the right first line of network segmentation. Reserve the paid services (WAF, Network Firewall, Shield Advanced) for when you actually need their deeper inspection and protection, and price those deliberately. Like asking whether IAM costs money, the answer is that the access-control primitive is free, the value-added protective services are what carry a charge.

FAQ

Are AWS security groups free?

Yes, completely. There is no charge to create, modify, or attach security groups, and no fee for the rules within reasonable defaults. Security groups are a built-in stateful firewall feature of the VPC. You can run a well-segmented network with many security groups and pay nothing for the groups themselves; only the resources they protect and the heavier paid network security services cost money.

What network security on AWS actually costs money?

The advanced services that are not security groups: AWS WAF charges per web ACL, per rule, and per million requests inspected; AWS Network Firewall charges an hourly endpoint fee plus data processed; and AWS Shield Advanced has a monthly subscription. Security groups and network ACLs are free. If your bill shows network security charges, it is one of the paid services, not the security groups.

Do security groups make protected resources cheaper?

No. A security group is free, but it does not change the cost of what it protects. The EC2 instances, load balancers, NAT gateways, and data transfer all bill normally whether or not a security group is attached. The firewall rules are free; the protected infrastructure is the actual bill. Wrapping a security group around an expensive resource neither adds nor reduces that resource's cost.

Is AWS WAF the same as a security group?

No. AWS WAF is a separate, paid web application firewall that inspects HTTP requests for application-layer threats and charges per web ACL, per rule, and per million requests. A security group is a free, built-in stateful firewall that filters traffic by port, protocol, and source at the network layer. They serve different purposes, and only WAF carries a charge.

How many security groups can I create for free?

AWS provides generous default limits on security groups per VPC and rules per group, and all of it is free within those limits. You can request limit increases if needed, still at no charge for the groups themselves. There is no per-group or per-rule fee, so cost is never a reason to under-segment; use as many security groups as good network design calls for.

Does C3X price network security resources?

C3X prices infrastructure from Terraform before deploy. Free resources like security groups and VPCs correctly show no cost, while paid network security services (WAF, Network Firewall) and the protected resources (instances, load balancers, NAT gateways) are costed against a live catalog. That gives you an accurate picture of what your network security actually adds to the bill before you deploy.

What to do next

See which resources are free and which cost money before you deploy. C3X prices your Terraform against a live resource catalog. Start with the quickstart.