Configuring Security Group Rules

Scenarios

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted within a VPC.

For security, you need to create security group rules to allow specific IP addresses and ports to access your RDS DB instance.

When you attempt to connect to an RDS DB instance through a private network, check whether the ECS and DB instance are in the same security group.

If they are in the same security group, they can communicate with each other by default. No security group rule needs to be configured.
If they are in different security groups, you need to configure security group rules for them, separately.
- RDS DB instance: Configure an inbound rule for the security group with which the RDS DB instance is associated.
- ECS: The default security group rule allows all outgoing data packets. In this case, you do not need to configure a security group rule for the ECS. If not all outbound traffic is allowed in the security group, you need to configure an outbound rule for the ECS.

Precautions

The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

By default, you can create a maximum of 100 security groups in your cloud account.
By default, you can add up to 50 security group rules to a security group.
One RDS DB instance can be associated with multiple security groups, and one security group can be associated with multiple RDS DB instances.
To enable access to an RDS DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the RDS DB instance.