One end of a rule: which traffic this side matches.

Fields intersect — { vpcId, port, protocol } is "traffic in that network, on that port, over that protocol". vmId/vpcId/tunnelId select by identity (the VM however it is addressed); cidr/public select by address. Unknown fields are rejected rather than ignored: a matcher is a security statement, and a typo'd porrt: 22 that quietly became "every port" is the wrong failure.

One end of a rule: which traffic this side matches.

Fields intersect — { vpcId, port, protocol } is "traffic in that network, on that port, over that protocol". vmId/vpcId/tunnelId select by identity (the VM however it is addressed); cidr/public select by address. Unknown fields are rejected rather than ignored: a matcher is a security statement, and a typo'd porrt: 22 that quietly became "every port" is the wrong failure.

What this rule depends on. Deleting any of them deletes this rule, so no rule is ever left pointing at something that no longer exists.

One end of a rule: which traffic this side matches.

Fields intersect — { vpcId, port, protocol } is "traffic in that network, on that port, over that protocol". vmId/vpcId/tunnelId select by identity (the VM however it is addressed); cidr/public select by address. Unknown fields are rejected rather than ignored: a matcher is a security statement, and a typo'd porrt: 22 that quietly became "every port" is the wrong failure.

One end of a rule: which traffic this side matches.

Fields intersect — { vpcId, port, protocol } is "traffic in that network, on that port, over that protocol". vmId/vpcId/tunnelId select by identity (the VM however it is addressed); cidr/public select by address. Unknown fields are rejected rather than ignored: a matcher is a security statement, and a typo'd porrt: 22 that quietly became "every port" is the wrong failure.