Consider the following example where two firewall rules exist:

An ingress rule from sources 0.0.0.0/0 (any IPv4 address) applicable to all targets, all protocols, and all destination ports, having a deny action and a priority of 1000.

An ingress rule from sources 0.0.0.0/0 (any IPv4 address) applicable to specific targets with the tag webserver, for traffic on TCP 80, with an allow action.

The priority of the second rule determines whether TCP traffic to port 80 is allowed for the webserver targets:

If the priority of the second rule is set to a number greater than 1000, it has a lower priority, so the first rule denying all traffic applies.

If the priority of the second rule is set to 1000, the two rules have identical priorities, so the first rule denying all traffic applies.

If the priority of the second rule is set to a number less than 1000, it has a higher priority, thus allowing traffic on TCP 80 for the webserver targets. Absent other rules, the first rule would still deny other types of traffic to the webserver targets, and it would also deny all traffic, including TCP 80, to instances without the webserver tag....