Comparing security groups in AWS and Azure

I understand that-

1.In Azure, we apply NSG(Network Security Groups) at subnet or individual NIC level(VM) whereas in AWS these can only be applied at individual VM level.
NACL is applied at subnet level in AWS.

2.In Azure, we have a column for source and destination IP address(for each of inbound and outbound categories).

I infer that due to Security Groups being applied at VM level in AWS, we define only destination IP for outbound rules(src being the VM) and source IP for inbound rules(dst being the VM).

Further,even for NACL in AWS, for inbound rule,only src IP can be defined .For outbound rule,only dst IP can be defined.

3.(AWS)Irrespective of inbound/outbound rules segregation, 'port' always refers to 'destination' side which listens on a specific port for traffic.
{This is usually the case with clients using a random port to connect to a server on a specific port like 80}

And unlike Azure, we cannot define both 'to' and 'from' ports while configuring inbound/outbound rules?
(in particular, we cannot define 'source' ports under either inbound/outbound section).

4.AWS defines only Allow rules whereas Azure has options for both allow and deny(security group).
Further,AWS has NACL which can contain both allow and deny statements.

5.Both AWS and Azure have 'stateful' concept, meaning an explicit rule for 'return' traffic response is not needed(define rules for only who gets to initiate the communication)—for security groups.

In AWS,we have NACL concept which is stateless,ie rules needed in both direction for communication to be successful.

Please correct me if I am missing something in my understanding.

Regards,
Aditya