When you create an Elastic Compute Service (ECS) instance connected to a Virtual Private Cloud (VPC) network, you can add the instance to the default security group, or select a user-created security group in the VPC network. A security group is a virtual firewall used to control the inbound and outbound traffic of ECS instances in the group.
This topic lists some commonly used security group settings for VPC-connected ECS instances.
Use case 1: Establish internal network connections
Communication between VPC-connected ECS instances includes the following:
- By default, ECS instances in the same security group of a VPC network can communicate with each other.
- ECS instances in different VPC networks cannot communicate with each other. To establish
a connection between two ECS instances in different VPC networks, you must use Express
Connect, VPN Gateway, or CEN to connect the VPC networks. Make sure that security
group rules for the ECS instances allow mutual access.
Security group rules Rule direction Authorization policy Protocol type and port range Authorization type Authorization object Security group configuration for the ECS instance in VPC 1 Inbound Allow Windows: RDP
3389/3389
CIDR block The private IP address of the ECS instance in VPC 2.Note Enter 0.0.0.0/0 to allow all ECS instances in VPC 2 to communicate with the ECS instance in VPC 1.Inbound Allow Linux: SSH
22/22
CIDR block Inbound Allow Custom TCP
Custom
CIDR block Security group configuration for the ECS instance in VPC 2 Inbound Allow Windows: RDP
3389/3389
CIDR block The private IP address of the ECS instance in the VPC 1.Note Enter 0.0.0.0/0 to allow all ECS instances in VPC 1 to communicate with the ECS instance in VPC 2.Inbound Allow Linux: SSH
22/22
CIDR block Inbound Allow Custom TCP
Custom
CIDR block
Use case 2: Block requests from specified IP addresses or ports
You can configure security groups for a VPC-connected ECS instance to block requests from specified IP addresses or ports.
Security group rules | Rule direction | Authorization policy | Protocol type and port range | Authorization type | Authorization object |
---|---|---|---|---|---|
Forbid IP addresses in a specified CIDR block to access all ports of the ECS instance | Inbound | Deny |
All -1 |
CIDR block |
The CIDR block to be blocked, such as 10.0.0.1/32. |
Forbid IP addresses in a specified CIDR block to access TCP port 22 of the ECS instance | Inbound | Deny |
SSH(22) 22/22 |
CIDR block |
The CIDR block to be blocked, such as 10.0.0.1/32. |
Use case 3: Allow only specified IP addresses to access an ECS instance through remote logon
Assume that you have assigned a public IP address to your VPC-connected ECS instance by using NAT Gateway or Elastic IP Address (EIP). In this case, you can add the following security group rules to allow remote logon through Windows or SSH logon through Linux.
Security group rules | Rule direction | Authorization policy | Protocol type and port range | Authorization type | Authorization object |
---|---|---|---|---|---|
Allow remote logon through Windows | Inbound | Allow |
RDP 3389/3389 |
CIDR block |
The IP address of the ECS instance that is allowed to be accessed.
Note Enter 0.0.0.0/0 to allow all public IP addresses to access the ECS instance.
|
Allow SSH logon through Linux | Inbound | Allow |
SSH 22/22 |
CIDR block |
The IP address of the ECS instance that is allowed to be accessed.
Note Enter 0.0.0.0/0 to allow all public IP addresses to access the ECS instance.
|
Use case 4: Allow users to access the HTTP/HTTPS service deployed on an ECS instance over the Internet
Assume that your website is hosted on a VPC-connected ECS instance and your website provides service to users on the Internet through an Elastic IP address or NAT Gateway instance. In this case, you must configure security group rules to allow users to access your website over the Internet.
Security group rules | Rule direction | Authorization policy | Protocol type and port range | Authorization type | Authorization object |
---|---|---|---|---|---|
Allow user traffic from HTTP port 80 | Inbound | Allow |
HTTP 80/80 |
CIDR block | 0.0.0.0/0 |
Allow user traffic from HTTPS port 443 | Inbound | Allow |
HTTPS 443/443 |
CIDR block | 0.0.0.0/0 |
Allow user traffic from TCP port 80 | Inbound | Allow |
TCP 80/80 |
CIDR block | 0.0.0.0 |