To allow traffic to an EC2 instance, add an inbound rule to its security group for the correct protocol, port or port range, and intended source. That permission does not start the application or guarantee that the rest of the network path works. For cross-account AWS placement, compare Availability Zone IDs—not lettered names such as us-east-1a, which can map to different physical zones in some Regions and accounts.
How to open a port in an EC2 security group
A security group controls allowed inbound and outbound traffic for the resources associated with it. Each rule specifies a direction and relevant network details, including protocol, port or range, and source for inbound traffic or destination for outbound traffic. See AWS’s security group overview.
As an Amazon Associate I earn from qualifying purchases.
Choose the rule that matches the traffic
For an inbound TCP or UDP service, create an ingress rule that permits the service’s protocol and port, and specify which clients may connect. AWS describes ingress rules in terms of protocol, source, and port requirements in its AuthorizeSecurityGroupIngress API reference.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
| Rule detail | What to check |
|---|---|
| Direction | Inbound for traffic arriving at the associated resource; outbound for traffic leaving it. |
| Protocol | Match the service, such as TCP or UDP. |
| Port or range | Enter the service’s listening port or required port range. |
| Source | For ingress, limit access to the intended client address or network range. |
Add the inbound rule
- Open the EC2 security group associated with the resource you want to reach.
- Edit its inbound rules and add a rule for the required protocol and port or range.
- Set the source to the intended client address or network range, then save the rule.
- Allow for a small propagation delay before testing. AWS says rule changes are applied to resources associated with the security group.
AWS’s EC2 security group CLI guide uses SSH on TCP port 22 and Windows RDP on TCP port 3389 as examples, and calls for specifying a source address or network range. Those examples do not justify exposing remote administration broadly; scope the source to the clients that need access.
#1 Best Overall
“Open the port” is shorthand for permitting network traffic through this control. A security-group rule does not make an application listen on that port. If the rule is correct but connections still fail, the security group alone cannot establish that the full path is configured: the service, addressing, routing, host firewall, and other relevant settings may also matter.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why us-east-1a can mean different zones
An Availability Zone (AZ) name combines a Region code and a letter. In certain older AWS Regions, accounts created before November 2025 can have independently mapped AZ names. As a result, us-east-1a in one account may identify a different physical location from us-east-1a in another. AWS documents the affected Regions and account-date distinction in its AZ IDs guide and Availability Zones overview.
This is not a rule that AZ names always differ across accounts. The Region and account creation date matter: AWS says accounts created starting November 2025 receive the same mapping in the affected Regions.
Use the AZ ID to coordinate placement
An AZ ID, such as use1-az1, identifies the same physical Availability Zone location across accounts. When aligning subnet placement across accounts, match the AZ IDs rather than assuming that matching letter suffixes indicate matching locations. AWS explains this approach in its guidance for consistent Availability Zones across accounts.
Rank #3
Check the name-to-ID mapping
You can inspect an account’s mapping in the EC2 console’s service health panel or query it with the AWS CLI. For the CLI, run:
aws ec2 describe-availability-zones --query "AvailabilityZones[].{Name:ZoneName,ID:ZoneId}" --output tableThe output pairs each account-visible ZoneName with its ZoneId. To query a different Region, add --region and that Region’s code to the command. Compare the IDs in each account before creating subnets intended to occupy corresponding physical zones.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
