Setting a Security Group Rule for a GeminiDB DynamoDB-Compatible Instance

Scenarios

A security group is a logical group providing access control rules for ECSs and GeminiDB DynamoDB-Compatible instances that have the same security needs and trust each other in a VPC. To ensure database security and reliability, you must configure security group rules to allow specific IP addresses and ports to access DynamoDB-Compatible instances. For more information about security groups, see Security Group Overview.

For details about the requirements for adding security group rules, see Adding a Security Group Rule in Virtual Private Cloud User Guide.

This section describes how to configure inbound rules for a GeminiDB DynamoDB-Compatible instance before connecting the instance through a private or public network.

Usage Notes

The default security group rule allows all outgoing traffic. An ECS and a GeminiDB DynamoDB-Compatible instance associated with the same security group can communicate with each other by default. After a security group is created, you can define custom access rules. Once a GeminiDB DynamoDB-Compatible instance is associated with the security group, the instance is protected by these rules.

• By default, a tenant can create a maximum of 500 security group rules.
• Too many security group rules will increase the first packet latency. You are advised to create a maximum of 50 rules for each security group.
• Currently, each GeminiDB DynamoDB-Compatible instance can be associated with only one security group.
• Security group rules must be configured before you connect to an instance through a private or public network. For details, see Table 1.

Procedure

1. Log in to the Huawei Cloud console.
2. On the Instances page, click the target instance name to go to the Basic Information page.
3. Configure security group rules.

   Method 1:

   In the Network Information area on the Basic Information page, click the name of the security group.

   Figure 1 Security group
   

   Method 2:

   On the Basic Information page, choose Connections in the navigation pane on the left. In the Security Group area on the right, click the name of the security group. The Security Group page is displayed.

   

4. Add an inbound rule.
   1. Click the Inbound Rules tab.
      Figure 2 Inbound rules
      

   2. Click Add Rule. The Add Inbound Rule dialog box is displayed.
      Figure 3 Adding a rule
      
   3. Add a security group rule as prompted.

      Table 2 Inbound rule settings

      Parameter	Description	Example Value
      Protocol & Port	Protocol: Currently, GeminiDB DynamoDB-Compatible API supports only TCP. Port: The port (1 to 65535) for accessing the ECS.	TCP
      Type	IP address type. This parameter is available after IPv6 is enabled. IPv4 IPv6	IPv4
      Source	The IP address, IP address group, or security group that the rule applies to, which allows access from IP addresses or instances in other security groups. For example: xxx.xxx.xxx.xxx/32 (IPv4 address) xxx.xxx.xxx.0/24 (subnet) 0.0.0.0/0 (any IP address) sg-abc (security group)	0.0.0.0/0
      Description	(Optional) Provides supplementary information about the security group rule. The description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).	-

5. Click OK.

Helpful Links

Changing the Security Group of a GeminiDB DynamoDB-Compatible Instance