This topic describes how to configure a security group for an ApsaraDB RDS for MySQL instance. The RDS security group can be associated with an Elastic Compute Service (ECS) security group to allow all ECS instances in the ECS security group to access the RDS instance.


After your RDS instance is created, you must configure IP address whitelists or security groups for the instance. Otherwise, your RDS instance is inaccessible. For more information about how to configure an IP address whitelist, see Configure an IP address whitelist for an ApsaraDB RDS for PostgreSQL instance.

For more information about security groups, see Create a security group.


  • You can configure both IP address whitelists and security groups. All the IP addresses in the configured IP address whitelists and all the ECS instances in the configured security groups are granted access to your RDS instance.
  • A maximum of 10 security groups can be configured for each RDS instance.
  • After the ECS instances in a configured security group are updated, the updates are automatically synchronized to the configured security group.
  • You can configure only a security group that has the same network type as your RDS instance. In this case, the network types of your RDS instance and the security group that you want to configure must both be VPC or classic network.
Note After you change the network type of your RDS instance, the security groups that you configured become invalid. You must configure the security groups of the specified network type again.


  1. Access RDS Instances, select a region at the top, and then click the ID of the target RDS instance.
  2. In the left-side navigation pane, click Whitelist and SecGroup. On the page that appears, click the Security Group tab.
  3. Click Add Security Group.
    Note Security groups followed by a VPC tag contain ECS instances that reside in virtual private clouds (VPCs).
    Security Group
  4. Select the security group that you want to add, and then click OK.

What to do next

Create a database and an account on an ApsaraDB RDS for PostgreSQL instance

Related operations

DescribeSecurityGroupConfigurationQueries details about the ECS security groups that are associated with an instance.
ModifySecurityGroupConfigurationModifies details about the ECS security groups that are associated with an instance.