All Products
Search
Document Center

ApsaraDB RDS:(Optional) Configure an ECS security group

Last Updated:Mar 28, 2026

The one-click cloud migration feature of ApsaraDB RDS for PostgreSQL migrates a self-managed PostgreSQL database from an Elastic Compute Service (ECS) instance to an RDS PostgreSQL instance. Before migration, add two inbound rules to the ECS security group so that the RDS instance can reach the self-managed database.

Prerequisites

Before you begin, ensure that you have:

  • An ECS instance and an ApsaraDB RDS for PostgreSQL instance in the same Virtual Private Cloud (VPC)

  • A PostgreSQL database deployed on the ECS instance

Add inbound security group rules

  1. Log on to the ECS console.

  2. In the left navigation pane, choose Instances & Images > Instances.

  3. In the top navigation bar, select the region where your ECS instance resides.

  4. Find the target ECS instance and click its instance ID.

  5. On the Security Groups tab, click the ID of the security group.

  6. On the Security Group Details page, go to the Rules section. On the Inbound tab, click Add Rule and add the following two rules.

    ProtocolDestination (This Instance)Source
    All ICMPNo configuration required. The default is All(-1/-1).VPC CIDR Block of the ApsaraDB RDS for PostgreSQL instance. See Find the VPC CIDR block below.

    Find the VPC CIDR block

    To get the VPC CIDR block of your RDS instance:

    1. Log on to the ApsaraDB RDS console and go to the Instances page.

    2. In the top navigation bar, select the region where the RDS instance resides, then click the instance ID.

    3. In the left navigation pane, click Database Connection.

    4. In the Network Type section, note the VPC CIDR block.

      VPC网段

    Custom TCP

    Port of the self-managed PostgreSQL database. Run netstat -a | grep PGSQL on the ECS instance to find the port.

What to do next

Configure the postgresql.conf file