Security Group Rule Calculator
Count the security group rules a design needs from sources and port combinations, and check the 60-rule and per-ENI budgets.
About Security Group Rule Calculator
A security group rule is one protocol, one port range and one source, so the rule count is the cross product of your sources and your port combinations — not the number of lines in a design document. The default quota is 60 inbound and 60 outbound rules per group with up to five groups per network interface, and referencing another security group as the source counts as a single rule no matter how many instances are in it. Rule counts grow multiplicatively, so a design that looks small on paper can blow the per-interface budget the moment a second port or a third environment is added.
Formula
Security Group Rule
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group.
- sources
- Unique CIDR blocks, prefix lists or referenced security groups
- combinations
- Unique protocol plus port-range pairs
- quota
- Inbound rules allowed in one security group
Worked example
With the default values below, Security Group Rule Calculator returns Inbound Rules Required of 40. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Distinct sources to allowaccepts 1–500 sources
- 8 sources
- Distinct protocol and port combinationsaccepts 1–200 combinations
- 5 combinations
- Distinct egress rules neededaccepts 0–500 rules
- 6 rules
- Inbound rules per security groupaccepts 10–1,000 rules
- 60 rules
- Security groups per network interfaceaccepts 1–16 groups
- 5 groups
Results
- Inbound Rules Required
- 40
- Security Groups Needed
- 1
- Total Rules Including Egress
- 46
- Interface Rule Budget Used
- 13.3%
- Rule Budget Check
- Fits in a single security group
Step by step
- 1Values used
- 2Security Group Rule
- 3Inbound Rules Required= 40
- 4Security Groups Needed= 1
- 5Total Rules Including Egress= 46
- 6Interface Rule Budget Used= 13.3
- 7Rule Budget Check= Fits in a single security group
Assumptions and limits
- The result is derived only from the 5 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 1 decimal place, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is Security Group Rule calculated?
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group. A security group rule is one protocol, one port range and one source, so the rule count is the cross product of your sources and your port combinations — not the number of lines in a design document. The default quota is 60 inbound and 60 outbound rules per group with up to five groups per network interface, and referencing another security group as the source counts as a single rule no matter how many instances are in it.
Why does Security Group Rule matter?
Rule counts grow multiplicatively, so a design that looks small on paper can blow the per-interface budget the moment a second port or a third environment is added.
What values do I need to enter?
This calculator takes 5 inputs: Distinct sources to allow, Distinct protocol and port combinations, Distinct egress rules needed, Inbound rules per security group, Security groups per network interface. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do managed prefix lists change the count?
A prefix list lets many CIDR blocks share one rule entry, which is the standard fix for source sprawl. Be aware that the list's maximum entry count, not its current size, is what counts against the rules-per-group quota, so size it deliberately.
Do I need egress rules at all?
Security groups are stateful, so return traffic for an allowed inbound flow is always permitted without an egress rule. Egress rules only matter when you replace the default allow-all outbound rule to restrict what a workload can initiate.