Stateful Packet Filtering
Filtering that tracks connection state, so return traffic for an allowed outbound connection is permitted automatically.
A stateful firewall — which is what cloud security groups are — records that you opened a connection and allows the reply without a matching inbound rule. This is why a security group with only an outbound rule works for an API call.
A stateless filter — which is what network ACLs are — evaluates each packet independently, so both directions need rules, including the ephemeral port range for return traffic. Forgetting that is the classic cause of "the security group allows it but the connection still fails".
The design implication: use security groups as the primary control, because they are stateful, instance-scoped and can reference other groups. Use network ACLs as a coarse secondary control at subnet level — blocking an address range wholesale — rather than as the main mechanism, where their statelessness makes rules error-prone.