Scenarios for security groups

Overview

You can configure security group rules for ECS instances in security groups to control instance access to the public network or internal networks. For information about how to create security groups and add security group rules, see Create a security group and Add security group rules. Common scenarios for security group rule configuration are listed as follows:

• Scenario 1: Allow instances in the same region under the same account to communicate with each other through an internal network

  If you need to copy resources between two ECS instances within the same region that are under the same account, you can add security group rules to allow the instances to communicate with each other through an internal network.

• Scenario 2: Allow instances in the same region but under different accounts to communicate with each other through an internal network

  If you need to copy resources between two ECS instances within the same region but under different accounts, you can add security group rules to allow the instances to communicate with each other through an internal network.

• Scenario 3: Allow only specified IP addresses access to your instance

  For security purposes, you can modify the port number for remote access to allow only specified IP addresses to connect to your ECS instance.

• Scenario 4: Allow your instance to access only specified public IP addresses

  For security purposes, you can add security group rules to allow your instance to access only specified public IP addresses.

• Scenario 5: Disallow your instance from accessing specified public IP addresses

  For security purposes, you can add security group rules to disallow your instance from accessing specified public IP addresses.

• Scenario 6: Allow public network access to your instance

  You can connect to your ECS instance from the public network.

• Scenario 7: Allow an ECS instance that resides in a security group belonging to another account in the same internal network to connect to your ECS instance

  You can connect to your instance from an ECS instance in a security group under another account in the same internal network.

• Scenario 8: Allow public network access to your ECS instance over HTTP or HTTPS

  If you host a website on your instance, you can add security group rules to allow your users to access the website through HTTP or HTTPS.

Scenario 1: Allow instances in the same region under the same account to communicate with each other through an internal network

Scenario 2: Allow instances in the same region but under different accounts to communicate with each other through an internal network

This scenario applies only to ECS instances in classic networks.

For example, User A owns the classic network-type instance Instance A in the China (Hangzhou) region. The instance has the internal IP address A.A.A.A and belongs to the security group Group A.

User B owns the classic network-type instance Instance B in the China (Hangzhou) region. This instance has the internal IP address B.B.B.B and belongs to the security group Group B.

To allow Instance A and Instance B to communicate with each other through the internal network, you must add security group rules in both Group A and Group B.

• Add the security group rule described in the following table in Group A.

  NIC type	Rule direction	Authorization policy	Protocol	Port range	Authorization type	Authorization object	Priority
  Internal	Inbound	Allow	Select an applicable protocol.	Specify a port range.	Security group under another account	The ID of the security group Group B. The account ID of User B must be entered in Account ID.	1

• Add the security group rule described in the following table to Group B.

  NIC type	Rule direction	Authorization policy	Protocol	Port range	Authorization type	Authorization object	Priority
  Internal	Inbound	Allow	Select an applicable protocol.	Specify a port range.	Security group under another account	The ID of security group Group A. The account ID of User A must be entered in Account ID.	1

  Note For security purposes, when you add an internal inbound security group rule of the classic network type, we recommend that you set Authorization Type to Security Group. If you set Authorization Type to CIDR Block, you can enter only a single CIDR block, for example, a.b.c.d/32. The CIDR block can be set as needed, but the subnet mask must be /32.

Scenario 3: Allow only specified IP addresses access to your instance

Scenario 4: Allow your instance to access only specified public IP addresses

After adding the security group rules, connect to your instance and run the ping or telnet command to check whether the security group rules have taken effect. If your instance can access only the allowed IP addresses, the security group rules have taken effect.

Scenario 5: Disallow your instance from accessing specified public IP addresses

Scenario 6: Allow public network access to your instance

For information about how to customize ports for remote access, see Modify the default remote access port.

Scenario 7: Allow an ECS instance that resides in a security group belonging to another account in the same internal network to connect to your ECS instance

Scenario 8: Allow public network access to your ECS instance over HTTP or HTTPS