Updated on 2022-01-25 GMT+08:00

Security Group

A security group is a collection of access control rules for ECSs that have the same security protection requirements and are mutually trusted within a VPC. After a security group is created, you can create different access rules for the security group, these rules will apply to any ECS that the security group contains.

Your account automatically comes with a default security group. The default security group allows all outbound traffic, denies all inbound traffic, and allows all traffic between ECSs in the group. Your ECSs in this security group can communicate with each other already without adding additional rules.

Figure 1 illustrates how the default security group works.

Figure 1 Default security group

Table 1 describes the default rules for the default security group.

Table 1 Rules in the default security group

Direction

Protocol

Port/Range

Source/Destination

Description

Outbound

All

All

Destination: 0.0.0.0/0

Allows all outbound traffic.

Inbound

All

All

Source: the current security group (for example, sg-xxxxx)

Allows communication among ECSs within the security group and denies all inbound traffic (incoming data packets).

Inbound

TCP

22

Source: 0.0.0.0/0

Allows all IP addresses to access Linux ECSs over SSH.

Inbound

TCP

3389

Source: 0.0.0.0/0

Allows all IP addresses to access Windows ECSs over RDP.

You can also create custom security groups and rules as required.

If two ECSs are in the same security group but in different VPCs, the ECSs cannot communicate with each other. To enable communications between the ECSs, use a VPC peering connection to connect the two VPCs first.