Configuring Security Group Rules

Scenarios

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted within a VPC.

This section describes how to create a security group to enable specific IP addresses and ports to access RDS.

First check whether the ECS and RDS DB instance are in the same security group.

• If the ECS and RDS DB instance are in the same security group, they can communicate with each other by default. No security group rule needs to be configured. Go to Connecting to a DB Instance from a Windows ECS.
• If the ECS and RDS DB instance are in different security groups, you need to configure security group rules for them, separately.
  • RDS DB instance: Configure an inbound rule for the security group with which the RDS DB instance is associated.
  • ECS: The default security group rule allows all outgoing data packets. In this case, you do not need to configure a security group rule for the ECS. If not all outbound traffic is allowed in the security group, you need to configure an outbound rule for the ECS.

This section describes how to configure an inbound rule for an RDS DB instance.

For details about the requirements of security group rules, see the Adding a Security Group Rule section in the Virtual Private Cloud User Guide.

Precautions

The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are deployed in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

• By default, you can create a maximum of 100 security groups in your cloud account.
• By default, you can add up to 50 security group rules to a security group.
• One RDS DB instance can be associated with multiple security groups, and one security group can be associated with multiple RDS DB instances.
• Too many security group rules will increase the first packet latency. You are advised to create no more than 50 rules for each security group.
• To enable access to an RDS DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the RDS DB instance.

To ensure the security of your data and DB instances, you are advised to use the principle of least privilege for database access. Change the default database port 1433, and set the IP address to the remote server's address or the remote server's smallest subnet address to control the access from the remote server.

The default value of Source is 0.0.0.0/0, indicating that RDS DB instances in the security group can be accessed from any IP address.

For details about the requirements of security group rules, see the Adding a Security Group Rule section in the Virtual Private Cloud User Guide.

Procedure

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Click in the upper left corner of the page and choose Databases > Relational Database Service.
4. On the Instances page, click the DB instance name.
5. Configure security group rules.
   In the Connection Information area on the Overview page, click the security group.

   Figure 1 Connection information
   

6. On the Inbound Rules tab, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.
   You can click + to add more inbound rules.

   Figure 2 Adding an inbound rule
   

   Table 1 Inbound rule parameter description

   Parameter	Description	Example Value
   Priority	Security group rule priority. Value range: 1 to 100. The default priority is 1 and has the highest priority. The security group rule with a smaller value has a higher priority.	1
   Action	Security group rule actions. A rule with a deny action overrides another with an allow action if the two rules have the same priority.	Allow
   Protocol & Port	Protocol: network protocol. Available options: All ports, Custom TCP, Custom UDP, ICMP, and GRE.	TCP
   	Port: the port over which the traffic can reach your DB instance. An RDS for SQL Server instance can use the default database port 1433 or any port from the range 2100-9500 (excluding 5355 and 5985). If your instance uses 2019 Enterprise Edition, 2019 Standard Edition, 2019 Web Edition, 2017 Enterprise Edition, 2017 Standard Edition, or 2017 Web Edition, ports 5050, 5353, and 5986 cannot be specified for it.	1433
   Type	IP address type.	IPv4
   Source	Source address. It can be a single IP address, an IP address group, or a security group to allow access from them to your DB instance. Examples: Single IP address: 192.168.10.10/32 (IPv4 address) IP address segment: 192.168.1.0/24 (IPv4 address segment) All IP addresses: 0.0.0.0/0 (any IPv4 address) Security group: sg-abc IP address group: ipGroup-test	0.0.0.0/0
   Description	Supplementary information about the security group rule. This parameter is optional. The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).	-