Manage security group rules efficiently using prefix lists - Elastic Compute Service

A prefix list is a collection of network prefixes (CIDR blocks). You can reference prefix lists when you configure security group rules. Modifying the entries of a prefix list is equivalent to directly modifying the security group rules. This helps you avoid maintaining multiple security group rules that differ only in their authorized IP addresses . This topic describes how to use prefix lists to efficiently manage security group rules.

Scenarios

To secure your cloud resources, you can divide them into multiple security zones, with each zone corresponding to a security group. If a common source, such as your on-premises office network, needs to access resources across these zones, managing access can be challenging, especially if the network addresses of that common source change frequently.

Without using a prefix list, you would need to maintain multiple security group rules that differ only by their source IP addresses. When the source network addresses change, you must update the rules across multiple security groups. The more security groups and network addresses you have, the more complex this task becomes.

With a prefix list, you can group the source network addresses and reference the list in your security group rules. When a network address changes, you only need to update the entry in the prefix list. The change automatically applies to all associated security group rules. This streamlines the management of access control policies and improves efficiency.

If your cloud resources are deployed in multiple Alibaba Cloud regions, you can use the prefix list clone feature to copy an existing prefix list to other regions.

Procedure

This procedure shows you how to use a prefix list to control which IP addresses can remotely connect to your instances, and how to modify these permissions later. This example involves two CIDR blocks.

Go to ECS Console - Prefix List.
In the upper-left corner of the page, select a region and resource group.
On the Prefix Lists tab, click Create Prefix List.
In the Create Prefix List dialog box, configure the parameters and click OK.
This example uses a prefix list that includes two IPv4 entries. The following parameters are for reference:
- Prefix List Name: RemoteAccess-IP
- Description: Allows the IP addresses in this list to access specific ECS instances.
- Address Family: IPv4
- Max Entries: 2
  
  Note
  When an associated resource, such as a security group, calculates its rule quota, it uses the Max Entries value, not the actual number of entries. Set this parameter to a reasonable value.
- Prefix List Entries: Click Add Entry to add 192.168.1.0/24 and 192.168.2.0/24.
  These CIDR blocks represent the following IP address ranges:
  - 192.168.1.0/24 represents IP addresses from 192.168.1.0 to 192.168.1.255.
  - 192.168.2.0/24 represents IP addresses from 192.168.2.0 to 192.168.2.255.
Use the prefix list in a security group rule.

Repeat the following steps to add a security group rule to multiple security groups. Use the prefix list RemoteAccess-IP as the source.
1. Go to ECS Console - Security Group.
2. Find the target security group and click Manage Rules in the Operation column.
3. On the Inbound tab, click Add Rule.
4. Configure the security group rule parameters and click Save.
  The following example parameters allow access to services on instances in the security group.
  - Authorization Policy: Allow
  - Priority: 1
  - Protocol Type: Custom TCP
  - Source: Select the prefix list RemoteAccess-IP.
  After you add the rule, the security group allows inbound traffic from the IP addresses in the prefix list.
Modify the entries in the prefix list.

After you add the security group rule, you may need to revoke remote access from some IP addresses to reduce risks. Instead of modifying rules in multiple security groups, you only need to modify the entries in the RemoteAccess-IP prefix list. For example, if you use instances with the private IP addresses 192.168.1.1 and 192.168.2.1 as bastion hosts, you can perform the following steps to allow remote connections only from the bastion hosts.
1. Go to ECS Console - Prefix List.
2. On the Prefix Lists tab, find the prefix list RemoteAccess-IP and click Details in the Operation column.
3. Click the Entries tab.
4. Find a prefix list entry and click Modify in the Operation column.
5. Set the CIDR Block parameter and click Save.
  
  Modify the two existing entries. Set their CIDR Block parameters to 192.168.1.1/32 and 192.168.2.1/32 respectively.
  
  These changes take effect immediately, updating all security group rules that reference the prefix list. The security groups now allow remote connections only from 192.168.1.1/32 and 192.168.2.1/32.