Controls inbound/outbound traffic; includes instance- and subnet-level security groups & network ACLs.