Operates at the subnet level (second layer of defense). Supports allow rules and deny rules. Is stateless: Return traffic must be explicitly allowed by rules. We process rules in number order when deciding whether to allow traffic. Automatically applies to all instances in the subnets it's associated with (backup layer of defense, so you don't have to rely on someone specifying the security group).