What are the differences between security groups and network ACLs?

A security group is a stateful, instance-level fine-grained firewall designed to control inbound and outbound traffic of individual cloud servers; a network ACL is a stateless, subnet-level border access control list used for overall isolation and protection of subnets. The two can be used together: the network ACL first implements coarse-grained control over the subnet, and then the security group performs fine-grained control on instances (for example, if an ACL permits access but the security group denies it, the access will be blocked).