How Do I Select and Configure a Security Group?

Updated on 2024-07-10 GMT+08:00

View PDF

To access an MQS instance within a VPC or over public networks, configure the security group rules as follows:

Intra-VPC Access

To access a ROMA Connect instance to which MQS belongs, you must deploy your client on an ECS in the same VPC and subnet as the instance. If they are deployed in different VPCs, see Does MQS Support Cross-VPC and Cross-Subnet Access?.

In addition, before you can access the instance through your client, you must configure correct rules for the security groups of both the ECS and ROMA Connect instance to which MQS belongs.

You are advised to configure the same security group for the ECS and ROMA Connect instance to which MQS belongs. After a security group is created, the security group rules, by default, include a rule allowing members in the security group to access each other without any restrictions.

If the ECS and ROMA Connect instance belong to different security groups, add security group rules to ensure that the ECS and ROMA Connect instance can access each other.

NOTE:

Assume that security groups sg-ecs and sg-romaconnect are configured respectively for your ECS and ROMA Connect instance to which MQS belongs.
The remote end is a security group or an IP address.

Add the following rule to the security group to which ECS belongs to ensure that the client can access MQS:

**Table 1** ECS security group rule
Direction	Protocol	Port	Destination
Outbound	All	All	sg-romaconnect

To ensure that your client can access the ROMA Connect instance to which MQS belongs, add the following rule to the security group configured for the instance:

**Table 2** MQS security group rule
Direction	Protocol	Port	Source
Inbound	All	All	sg-ecs

Public Access

Configure security group rules based on Table 3 for the client to access the MQS instance.

**Table 3** Security group rules for public access
Direction	Protocol	Port	Source	Description
Inbound	TCP	9094	0.0.0.0/0	Access MQS through the public network (without SASL authentication).
Inbound	TCP	9095	0.0.0.0/0	Access MQS through the public network (with or without SASL authentication).
Inbound	TCP	9096	0.0.0.0/0	Access MQS through the public network (with or without SASL authentication).
Inbound	TCP	9097	0.0.0.0/0	Access MQS through the public network (with SASL authentication).