Documentation
Home Page Server Load Balancer Application Load Balancer Security Protection Add an ALB instance to a security group

Add an ALB instance to a security group

Updated at:
Copy as MD
Product

Add ALB instances to security groups to control inbound and outbound traffic. Security groups act as virtual firewalls with stateful inspection and packet filtering.

Important

Upgraded ALB instances support both security groups and access control lists (ACLs) for incoming traffic control. Non-upgraded instances support only ACLs. To use security groups, create new ALB instances or contact your account manager to upgrade existing ones.

Security group overview

Security groups are classified into managed security groups and custom security groups. Managed security groups are created by cloud services — you can view but cannot modify, delete, or add instances to them. Custom security groups are ones you create, divided into basic and advanced security groups.

When you create an ALB instance, a managed security group is automatically created in the same VPC. This managed security group includes the following default rules:

  • Priority-1 rules that allow inbound traffic to the ALB local IP addresses used for backend server health checks.

  • Priority-100 rules that allow all inbound traffic.

  • Priority-1 rules that allow all outbound traffic.

With only the managed security group, all traffic is allowed. To restrict access, add the ALB instance to custom security groups.

How rules work

When your ALB instance is added to custom security groups:

  • Allow rules only: all traffic remains allowed.

  • Allow rules at higher priorities + a catch-all Deny rule at the lowest priority: only traffic to and from the specified IP addresses is allowed.

  • Deny rules only: traffic to and from the specified IP addresses is denied.

By customizing security group rules, you can allow or deny access from specific IP addresses or based on protocols and ports.

Limitations

Custom security groups for ALB instances have the following limitations:

  • They must belong to the same VPC as the ALB instance.

  • The maximum number of custom security groups equals the security group quota per Elastic Compute Service (ECS) elastic network interface (ENI) minus 1 (reserved for the managed security group).

  • The maximum number of rules equals the rule quota per ECS ENI minus the rules in the managed security group.

  • An ALB instance can use only one type of custom security group (basic or advanced). To switch types, remove the instance from all current security groups first, then add it to security groups of the other type.

Considerations

  • Outbound traffic includes requests forwarded to backend servers and responses sent to clients. Do not configure outbound rules for ALB security groups to avoid service interruptions.

  • Do not configure priority-1 Deny rules targeting the ALB local IP addresses. These rules block health checks between the ALB instance and backend servers.

Security groups vs. ACLs

Security groups and ACLs both filter traffic for ALB instances, with these differences:

  • Security groups:

    • Control traffic per instance or per listener (for specific ports).

    • Support simultaneous allow and deny rules.

    • Support IPv4 and IPv6.

  • ACLs:

    • Control traffic per listener only.

    • Set a list of IP addresses as either a whitelist or blacklist.

    • Support IPv4 only.

Add your ALB instance to a security group

Prerequisites

  • An ALB instance is created.

  • A security group is created and security group rules are configured.

    Note

    ALB security groups are managed through ECS. To create, modify, or delete security groups or rules, use the ECS console. The ALB console only supports adding or removing ALB instances from existing security groups and viewing security group settings.

Console

  1. Go to ALB console - Instances.

  2. In the top navigation bar, select the region.

  3. Click the ID of the ALB instance.

  4. On the instance details page, click the Security Groups tab.

  5. Click Create Security Group.

  6. In the Add ALB to Security Group dialog box, select at least one security group. Use Resource Group to filter results. In the Security Groups drop-down list, click Create Security Group to create a new security group in the ECS console. After selection, click OK.

  7. On the Security Groups tab, verify the security group settings. Click Create Security Group to add more security groups.

    To edit rules, click ECS Console or click the security group ID in the Basic Information section.

API

Call the LoadBalancerJoinSecurityGroup operation.

Remove your ALB instance from a security group

Console

  1. Go to ALB console - Instances.

  2. In the top navigation bar, select the region.

  3. Click the ID of the ALB instance.

  4. On the instance details page, click the Security Groups tab.

  5. Click the security group name or ID, then click Remove in the upper-right corner.

  6. In the Remove dialog box, click OK.

API

Call the LoadBalancerLeaveSecurityGroup operation.

Previous：Security ProtectionNext：Use security groups to control access based on ports