Security Groups are virtual firewalls in AWS that control inbound and outbound traffic for resources such as Amazon EC2 instances. They allow only the traffic you explicitly define.
A Web Server Security Group allows traffic like HTTP (80) and HTTPS (443) from the internet. A Bastion Host Security Group allows SSH (22) access only from trusted IP addresses. A Database Security Group allows database ports (such as 3306 for MySQL) only from the application or web server, not from the internet.
In simple words, Security Groups protect AWS resources by allowing only authorized network traffic to reach them.