These define what network traffic is allowed in and also out. They wrap around the compute (and some other) resources that you launch. One or more resources can belong to a group. Server instances, databases, and cluster nodes all require them. They block everything by default, so you must specify what traffic to allow. This is an important safety net. For example, even if you launch a new Linux server and make it totally open and vulnerable to the world (but do not do that) as long as the security group is locked down, no malicious traffic can get to it. Cloud environments are very much a trust no-one world.