Security group is stateful. It automatically allows return traffic for any outbound or inbound request that is explicitly allowed, without needing an additional rule to permit the return traffic.
Security groups keep track of the state of network connections. When a connection is initiated (inbound or outbound), the security group remembers the connection state.
Security Group Documentation:
https://docs.aws.amazon.com/vpc/lates...