Security Group Rule Calculator
Count the security group rules a design needs from sources and port combinations, and check the 60-rule and per-ENI budgets.
Inputs
A CIDR block, a prefix list or another security group.
Inbound Rules Required
40
Security Groups Needed
1
Total Rules Including Egress
46
Interface Rule Budget Used
13.3%
Rule Budget Check
Fits in a single security group
Step by step
Values used
Distinct sources to allow = 8 sources; Distinct protocol and port combinations = 5 combinations; Distinct egress rules needed = 6 rules; Inbound rules per security group = 60 rules; Security groups per network interface = 5 groups
Security Group Rule
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group.
Inbound Rules Required
= 40
Security Groups Needed
= 1
Total Rules Including Egress
= 46
Interface Rule Budget Used
= 13.3
Rule Budget Check
= Fits in a single security group
How it works
A security group rule is one protocol, one port range and one source, so the rule count is the cross product of your sources and your port combinations — not the number of lines in a design document. The default quota is 60 inbound and 60 outbound rules per group with up to five groups per network interface, and referencing another security group as the source counts as a single rule no matter how many instances are in it. Rule counts grow multiplicatively, so a design that looks small on paper can blow the per-interface budget the moment a second port or a third environment is added.
Formula
Security Group Rule
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group.
- sources
- Unique CIDR blocks, prefix lists or referenced security groups
- combinations
- Unique protocol plus port-range pairs
- quota
- Inbound rules allowed in one security group
Frequently Asked Questions
How is Security Group Rule calculated?
inbound rules = sources × protocol and port combinations; groups needed = ceil(inbound rules ÷ rules per group); interface budget = groups per interface × rules per group. A security group rule is one protocol, one port range and one source, so the rule count is the cross product of your sources and your port combinations — not the number of lines in a design document. The default quota is 60 inbound and 60 outbound rules per group with up to five groups per network interface, and referencing another security group as the source counts as a single rule no matter how many instances are in it.
Why does Security Group Rule matter?
Rule counts grow multiplicatively, so a design that looks small on paper can blow the per-interface budget the moment a second port or a third environment is added.
What values do I need to enter?
This calculator takes 5 inputs: Distinct sources to allow, Distinct protocol and port combinations, Distinct egress rules needed, Inbound rules per security group, Security groups per network interface. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
How do managed prefix lists change the count?
A prefix list lets many CIDR blocks share one rule entry, which is the standard fix for source sprawl. Be aware that the list's maximum entry count, not its current size, is what counts against the rules-per-group quota, so size it deliberately.
Do I need egress rules at all?
Security groups are stateful, so return traffic for an allowed inbound flow is always permitted without an egress rule. Egress rules only matter when you replace the default allow-all outbound rule to restrict what a workload can initiate.