security group
termcloudsecurity
The cloud's stateful per-instance firewall: allow rules attached to workloads, return traffic implied, default deny inbound.
Follows the instance wherever it moves - the rule set is tied to the workload, not the wire.