Elastic Compute Service:Security groups for different use cases

Take note of the following items about security group rules:

• Security groups that contain no rules deny all inbound access.

• By default, basic security groups allow all outbound access.

• Instances within different security groups that contain no rules are isolated from each other over the internal network.

• In security groups of the Virtual Private Cloud (VPC) type, each rule controls access to or from the Internet and the internal network.

• In security groups of the classic network type, public rules (Internet ingress and Internet egress rules) control access to or from the Internet, whereas internal rules (inbound and outbound rules) control access to or from the internal network.

• All sample rules described in this topic are configured for the default ports used by typical applications. Applications deployed on instances use ports of the instances to provide external services. For more information, see Common ports.

If a website deployed on your instance needs to provide external web services, you must add the security group rules described in the following table to allow inbound access to the required ports such as ports 80 (HTTP) and 443 (HTTPS).

Before you can connect to an instance from an on-premises server, you must add security group rules to allow inbound access to the required ports based on your connection method. For example, to connect to a Linux instance by using Secure Shell (SSH), you must add a rule that allows inbound SSH access to port 22. To connect to a Windows instance by using the Remote Desktop Protocol (RDP), you must add a rule that allows inbound RDP access to port 3389. The following table describes the sample rules.

When you use Alibaba Cloud Workbench to connect to an instance, you must add security group rules to allow access to specified servers. The following table describes the sample rules.

If you want to share data between instances from different security groups within the same VPC, such as when you want instances within Security Group A to access shared files on instances within Security Group B over FTP, you can add rules to allow mutual access between the security groups over the internal network. The preceding method is more convenient than adding rules to allow access to or from individual IP addresses or CIDR blocks. You do not need to separately configure access control for each instance within each security group.

If you deployed databases on your instance and want other instances to obtain data from the databases over the internal network, you must add rules to allow inbound access to the required ports based on the database types. Default port numbers for common database systems:

• MySQL (3306)

• Oracle (1521)

• MS SQL (1433)

• PostgreSQL (5432)

• Redis (6379)

The following table describes the sample rules.

The Internet Control Message Protocol (ICMP) is used to transmit control messages. Before you can perform specific test operations, such as running the ping command on a client to ping your instance, you must add rules to allow inbound ICMP access. The following table describes the sample rules.

By default, basic security groups allow all outbound access. To allow instances within a basic security group to access only specific websites, you can use the security group as a whitelist and add a Forbid rule that denies all outbound access and then Allow rules that allow outbound access to the IP addresses of the websites.

The following table describes the sample rules.