AuthorizeSecurityGroup

Description

We define the beginning of the traffic as the source, and the terminal of the traffic as the destination, see the following picture.

When you call this interface, consider the following:

• You can add up to 100 authorization rules to one security group.

• You can set the authorization policies to accept or drop.

• The Priority of a security group ranges from 1 to 100. Here, smaller the number, higher the priority is.

• If the priorities of several authorization rules are the same, drop rules take the precedence.

• The source device can be an instance with the specified IP address range (SourceCidrIp) or an instance in another security group (SourceGroupId).

• Use the following two sets of parameters to add a security group rule. If one rule already exists according to the two sets of parameters, the AuthorizeSecurityGroup fails.

  • To set the access permission of an IP address range, for example, Request example 1: IpProtocol, PortRange, (Optional) SourcePortRange, NicType, Policy, (Optional) DestCidrIp and  SourceCidrIp.

  • To set the access permission of instances that are in another security group, for example, Request example 2: IpProtocol, PortRange, (Optional) SourcePortRange, NicType, Policy, (Optional) DestCidrIp, SourceGroupOwnerAccount, and SourceGroupId.

Request parameters

Response parameters

All are common response parameters. See Common response parameters.

Examples

Grant access permission to a specified IP address range. You can set theNicType for a classic network-connected security group to internet or intranet. The NicType of a VPC-Connected security group can be set to intranet only.

https://ecs.aliyuncs.com/?Action=AuthorizeSecurityGroup
&SecurityGroupId=sg-F876FF7BA
&SourceCidrIp=0.0.0.0/0
&IpProtocol=tcp
&PortRange=1/65535
&NicType=intranet
&Policy=Allow
&<Common Request Parameters>

Request example 2

Grant the access permission of another security group. The NicType can be set to intranet only. For mutual accesses between classic network-connected security groups, you can set the permission for another security group in the same region to access your security group. This security group can be yours or belong to other SourceGroupOwnerAccount. For mutual accesses between VPC-Connected security groups, you can set the permission for another security group in the same VPC to access your security group.

https://ecs.aliyuncs.com/?Action=AuthorizeSecurityGroup
&SecurityGroupId=sg-F876FF7BA
&SourceGroupId=sg-1651FBB64
&SourceGroupOwnerAccount=test@aliyun.com
&IpProtocol=tcp
&PortRange=1/65535
&NicType=intranet
&Policy=Drop
&<Common Request Parameters>

XML format

<AuthorizeSecurityGroupResponse>
    <RequestId>CEF72CEB-54B6-4AE8-B225-F876FF7BA984</RequestId>
</AuthorizeSecurityGroupResponse>

{
    "RequestId":"CEF72CEB-54B6-4AE8-B225-F876FF7BA984"
}

Error codes