Configuring Security Group Rules

Scenarios

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted within a VPC.

This section describes how to create a security group to enable specific IP addresses and ports to access RDS.

When you attempt to connect to an RDS DB instance through an EIP, you need to configure an inbound rule for the security group associated with the DB instance.

Precautions

The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are deployed in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

• By default, you can create a maximum of 100 security groups in your cloud account.
• By default, you can add up to 50 security group rules to a security group.
• One RDS DB instance can be associated with multiple security groups, and one security group can be associated with multiple RDS DB instances.
• Too many security group rules will increase the first packet latency. You are advised to create no more than 50 rules for each security group.
• To enable access to an RDS DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the RDS DB instance.

The default value of Source is 0.0.0.0/0, indicating that RDS DB instances in the security group can be accessed from any IP address.

Procedure

1. Under Network, click Virtual Private Cloud.
2. In the navigation pane on the left, choose Access Control > Security Groups.
3. On the Security Groups page, locate the target security group and click Manage Rule in the Operation column.
4. On the displayed page, click Add Rule.
5. In the displayed dialog box, set required parameters to add an inbound rule.
6. Click OK.