AWS Security Groups are free. Per the EC2 user guide: ‘There is no additional charge for using security groups.’ Zero hourly fee, zero per-rule fee. The team that uses security groups has virtual firewalls at no cost. The team that thinks there’s a cost is wrong - but the common confusion is reasonable since AWS charges for many other security features.
Table of contents
Security Groups are free
Per the AWS docs:
There is no additional charge for using security groups.
The team that uses security groups has free virtual firewalls.
What’s NOT free
Other AWS networking/security charges:
- NAT Gateway: $0.045/hour + data processing.
- VPC Endpoint (Interface): $0.01/hour + $0.01/GB.
- Public IPv4 addresses: $0.005/hour (since Feb 2024).
- Network Load Balancer: $0.0225/hour + $0.006/GB.
- ALB: $0.0225/hour + $0.008/GB.
- WAF: $5/month + per-request.
- GuardDuty: per-GB analyzed.
The team that knows what costs money avoids bill surprises.
Why the confusion
Security Groups are confusingly free because:
- AWS charges for many VPC features.
- Network firewalls in some clouds cost.
- The team that assumes ‘AWS charges for everything’ is wrong about SGs.
The cost is in the resources
Security groups protect:
- EC2 instances (paid).
- ALBs/NLBs (paid).
- RDS databases (paid).
- ECS tasks (paid).
- Lambda (paid by request).
The team that uses SGs has free firewall - they pay for the resources it protects, not the SG itself.
FAQ
Do security groups cost money?
No. Free. The team that uses SGs has virtual firewalls at no cost.
Are there limits on security groups?
Yes - default 2,500 SGs per region, 60 inbound + 60 outbound rules per SG. The team that has complex rules uses multiple SGs.
Do NACLs cost money?
No - Network ACLs are also free. The team that uses NACLs has stateless firewall rules at no cost.
What’s the difference between Security Groups and NACLs?
Security Groups: stateful, instance-level. NACLs: stateless, subnet-level. The team that uses both has defense in depth.
Do VPCs cost money?
No - VPCs themselves are free. The team that has a VPC pays for the resources in it (NAT Gateway, NLB, etc.) but not the VPC.
If you are sizing the infrastructure for the kind of project this post covers, the RunxBuild hosting calculator is the right place to model the line items. The compute, the memory, the storage, the bandwidth, the database - each one is a separate number, and the team’s mental model for the platform is the sum of those numbers. The RunxBuild dashboard is where the team sees the actual usage in one place.
Useful related references: