Security groups act as a firewall for associated instances, controlling both inbound and outbound traffic at the instance level.