AWS describes security groups as virtual firewalls. While this analogy helps newcomers to the EC2 platform understand their purpose and function, it's probably more accurate to describe them as a firewall-like method of authorizing traffic. They don't offer all the functionality you'd find in a traditional firewall, but this simplification also makes them extremely powerful, particularly when combined with Infrastructure as Code and modern SDLC practices.
We're going to go through a basic scenario involving a web server and load balancer. We want the load balancer to respond to HTTP requests from everywhere, and we want to isolate the web server from everything except the load balancer.