>if you have insufficient funds they'll take out a margin loan
That's not my experience with them. I've had them as a checking/brokerage account for 10+ years. I tend not to keep much money in checking so I run into timing issues once a year or so - where a check I wrote will present before the funds to cover it arrive in my account. I've definitely had them pull from the brokerage cash, but not from savings. They have never opened a margin loan to cover it.
Yes and no. NACLs are, indeed, associated with a subnet so more of a networking construct. It's somewhat a firewall, but it's also stateless which is different than many (non-network engineer) people's mental model of a firewall.
Security Groups have some key differences from a host-based firewall. A packet destined for an EC2 instance will not make it to the instance IP stack and be evaluated there, it will be evaluated before it gets there.
It depends on your audience. A web dev that's relatively new to syadmin tasks... sure, it's like a host based firewall. For a syadmin or network admin, that explanation might be more confusing than helpful.
That's not my experience with them. I've had them as a checking/brokerage account for 10+ years. I tend not to keep much money in checking so I run into timing issues once a year or so - where a check I wrote will present before the funds to cover it arrive in my account. I've definitely had them pull from the brokerage cash, but not from savings. They have never opened a margin loan to cover it.