Security groups and roles can be a bit tricky to comprehend so I made a 3 part tutorial which covers it in small incremental steps and wanted to get your feedback if I forgot to cover something vital:
Part 1: https://youtu.be/bIUIrCc48iE
Part 2: https://youtu.be/H9RCexuHqI4
Part 3: https://youtu.be/Lr3ospKvIcE
One comment I got is that I forgot to cover default security groups, so will def add it in part 4.