What is the difference between Security Groups and NACLs?

Security Groups are stateful firewalls at the instance level that allow rules only. NACLs (Network Access Control Lists) are stateless firewalls at the subnet level that support both allow and deny rules.