Each ECS instance must join at least one security group. For more information, see Security groups.

If you do not have a security group when your create an ECS instance, you can use the default one provided by the system. For more information, see  Default security group rules.

Alternatively, you can create a security group to meet your business needs and add your instances to it. This article describes how to create a security group.

Prerequisite

To create a VPC-Connected security group, you must Manage a VPC.

Note

You can create a VPC-Connected security group across VSwitches, but not across VPCs.

Procedure

  1. Log on to the  ECS console.
  2. Select a region.
  3. In the left-side navigation pane, select Networks & Security > > Security group.
  4. Click Create Security Group.
  5. In the Create Security Group dialog box, complete the following configurations:
    • Template: If the instances in the security group are for Web server deployment, select an ideal template to simplify security group rule configuration.
      Setting Template Note
      To deploy a Web server on the Linux instances in the security group. Web Server Linux By default, inbound traffic to port TCP 80, TCP 443, TCP 22, and for ICMP is allowed.
      To deploy a Web server on the Windows instances in the security group. Web Server Windows By default, inbound traffic to port TCP 80, TCP 443, TCP 3389, and for ICMP is allowed.
      Not for Web server Custom After the security group is created, add a security group rule to meet your business needs. Add security group rules
    • Security Group Name: Specify a valid security group name.
    • Description: Give a brief to the security group for future management.
    • Network Type:
      • To create a VPC-Connected security group, select VPC and then a specific VPC.
      • To create a classic network-connected security group, select Classic.

  6. Click OK to save the rule.

For a new security group without any rules, the following default rules apply to the communication of all the instances in the group over Internet or intranet. Outbound: Allow all for outbound traffic. Inbound: Drop all for inbound traffic.

Follow-up operations

After you create a security, Add security group rules.

To meet your business needs, Add to or remove from a security group.

Related APIs

CreateSecurityGroup