Stateful means you never write the return rule.

Every Security Group rule is an allow — there's no explicit deny, only an implicit one.

# inbound rule — the only rule you write

Type: HTTPS   Port: 443   Source: sg-app-tier
# the response traffic is automatically allowed outbound —
# no matching outbound rule needed. That's "stateful."

Reference another Security Group as the source, not a CIDR range, whenever the source is inside AWS — it survives an IP changing entirely, since it tracks identity, not address.