The following are some of the ways in which a security group differs from traditional firewalls:

• Security groups can't be used to explicitly block traffic. Only rules of a permissive kind can be added; deny style rules are not supported. Essentially, all inbound traffic is denied unless you explicitly allow it.
• Your rules may not refer to source ports; only destination ports are supported.
• When security groups are created, they will contain a rule that allows all outbound connections. If you remove this rule, new outbound connections will be dropped. It's a common pattern to leave this rule in place and filter all your traffic using inbound rules only.
• If you do replace the default outbound rule, it's important to note that only new outbound connections will be filtered. Any outbound traffic being sent in response to an inbound connection will still be allowed. This is because security groups are stateful.
• Unlike security groups, network ACLs are not stateful and support DENY rules. You can use them as a complementary layer of security inside your VPC, especially if you need to control traffic flow between subnets.