Elastic Compute Service:Habilitar a comunicação entre instâncias da rede clássica em diferentes grupos de segurança

Method 1: Authorize by single IP address

Use cases

A small number of classic network ECS instances need internal network communication.

Pros and cons

• Pro: Rules are clear and easy to understand.

• Con: May hit the 200-rule limit per security group. Maintenance workload is high.

Procedure

1. Find the classic network instance and click its instance ID.

2. On the Instance Details page, click the Security Group tab.

3. Find the security group to configure, and in the Operation column, click or Configure Rules.

4. Click the Inbound tab.

5. Click 手动添加 and add a security group rule with the following settings.

   • Authorization policy: Allow.

   • Priority: Set as needed. Default: 1.

   • Protocol Type: Select as needed.

   • Port Range: Set as needed.

   • Authorization Object: Enter the private IP address of the source instance in a.b.c.d/32 format. The subnet mask must be /32.

     

6. Click Save.

Method 2: Add instances to the same security group

Use cases

Simple application architectures where all instances can share one basic security group.

Pros and cons

• Pro: Rules are clear and easy to review.

• Con: Only works for simple architectures. If the network architecture changes, you must update the authorization method.

Procedure

See Associate a security group with an instance (primary network interface card).

Method 3: Attach a dedicated security group for communication

Use cases

Multilayer application architectures that require a dedicated security group for internal communication.

Pros and cons

• Pro: Works for complex network architectures.

• Con: Instances belong to multiple security groups, making rules harder to read.

Procedure

1. Create a basic security group for the classic network (for example, a communication security group). No rules are needed. See Create a security group.

2. Attach the communication security group to all instances that require communication. Instances in the same basic security group can communicate over the internal network. See Associate a security group with an instance (primary network interface card).

Method 4: Authorize between security groups

Use cases

Multilayer application architectures where instances authorize each other by security group ID.

Pros and cons

• Pro: Works for complex network architectures.

• Con: Instances belong to multiple security groups, making rules harder to read.

Procedure

1. Find the classic network instance and click its instance ID.

2. On the Instance Details page, click the Security Group tab.

3. Find the security group to configure, and in the Operation column, click or Configure Rules.

4. Click the Inbound tab.

5. Click 手动添加 and add a security group rule with the following settings.

   • Authorization policy: Allow.

   • Priority: Set as needed. Default: 1.

   • Protocol Type: Select as needed.

   • Port Range: Set as needed.

   • Authorization Object:

     • Within your account: Enter the destination security group ID.

     • Cross-account: Enter the destination account ID and security group ID in AccountID/SecurityGroupID format.

6. Click Save.