Each ECS instance must join at least one security group. For more information, see security group.

If you do not have a security group when your create an ECS instance, you can use the default one provided by the system. For more information, see default security group rules.

Alternatively, you can create a security group to meet your business needs and add your instances to it. This article describes how to create a security group.

Prerequisite

To create a VPC-connected security group, you must manage a VPC.

Note

You can create a VPC-connected security group across VSwitches, but not across VPCs.

Procedure

  1. Log on to the  ECS console.
  2. In the left-side navigation pane, select Networks and Security > > Security Groups.
  3. Select a region.
  4. Click Create Security Group.
  5. In the Create Security Group dialog box, complete the following configurations:
    • Template: If the instances in the security group are for Web server deployment, select proper template to simplify security group rule configuration.
      Setting Template Note
      To deploy a Web server on the Linux instances in the security group Web Server Linux By default, inbound traffic to TCP 80, TCP 443, TCP 22, and ICMP is allowed.
      To deploy a Web server on the Windows instances in the security group Web Server Windows By default, inbound traffic to port TCP 80, TCP 443, TCP 3389, and ICMP is allowed.
      Not for Web server Custom After the security group is created, add security group rules to meet your business needs.
    • Security Group Name: Specify a valid security group name.
    • Description: Give a brief description to the security group for future management.
    • Network Type:
      • To create a VPC-connected security group, select VPC and then a specific VPC.
      • To create a classic network-connected security group, select Classic.

  6. Click OK to save the rule.
For a new security group without any rules, the following default rules apply to the communication of all the instances in the group over the Internet or intranet:
  • Outbound: Allow
  • Inbound: Refuse

Follow-up operations

After you create a security, add security group rules.

To meet your business needs, add/remove an instance to/from a security group.

Related API

CreateSecurityGroup