Count the security group rules a design needs from sources and port combinations, and check the 60-rule and per-ENI budgets.
A security group rule is one protocol, one port range and one source, so the rule count is the cross product of your sources and your port combinations — not the number of lines in a design document. The default quota is 60 inbound and 60 outbound rules per group with up to five groups per network interface, and referencing another security group as the source counts as a single rule no matter how many instances are in it. Rule counts grow multiplicatively, so a design that looks small on paper can blow the per-interface budget the moment a second port or a third environment is added.
Security Group Rule
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group.
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group. A security group rule is one protocol, one port range and one source, so the rule count is the cross product of your sources and your port combinations — not the number of lines in a design document. The default quota is 60 inbound and 60 outbound rules per group with up to five groups per network interface, and referencing another security group as the source counts as a single rule no matter how many instances are in it.
Rule counts grow multiplicatively, so a design that looks small on paper can blow the per-interface budget the moment a second port or a third environment is added.
This calculator takes 5 inputs: Distinct sources to allow, Distinct protocol and port combinations, Distinct egress rules needed, Inbound rules per security group, Security groups per network interface. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
A prefix list lets many CIDR blocks share one rule entry, which is the standard fix for source sprawl. Be aware that the list's maximum entry count, not its current size, is what counts against the rules-per-group quota, so size it deliberately.
Security groups are stateful, so return traffic for an allowed inbound flow is always permitted without an egress rule. Egress rules only matter when you replace the default allow-all outbound rule to restrict what a workload can initiate.