Security Group
also called Firewall Rules, NSG
A stateful, instance-level firewall that allows specified traffic and denies everything else by default.
The properties that make it the primary network control in cloud: it is default-deny, it is stateful (a reply to an allowed outbound connection is permitted without a matching inbound rule), and its rules can reference other security groups rather than IP ranges.
That last property is the one to exploit. "Allow 5432 from the application security group" keeps working as instances come and go, autoscale and change addresses, and it expresses the intended architecture directly. Rules written against CIDR blocks describe a topology that drifts.
Contrast with network ACLs, which are subnet-level and stateless — coarser, and requiring explicit rules in both directions. Use them as a secondary broad control, not as the main mechanism. Restricting outbound traffic is the step most teams skip and the one that limits what an attacker can exfiltrate.