How Do I Select and Configure a Security Group?
Kafka instances can be accessed within a VPC, across VPCs, through DNAT, or over public networks. Before accessing a Kafka instance, configure a security group.
Intra-VPC Access
- Check whether the client and instance use the same security group.
- If they use the same security group, check whether the security group has the default inbound rule that allows communication among ECSs within the security group and the default outbound rule that allows all outbound traffic. If these rules are available, you do not need to add more rules. If these rules are not available, add rules according to Table 1.
- If they use different security groups, go to 2.
- Configure security group rules as follows.
Assume that the security groups of the client and Kafka instance are sg-53d4 and Default_All, respectively. You can specify a security group or IP address as the destination in the following rule. A security group is used as an example.
To ensure that your client can access the Kafka instance, add the following rule to the security group configured for the client:
Table 2 Security group rule Direction
Action
Protocol & Port
Destination
Outbound
Allow
All
Default_All
Figure 1 Configuring a security group for the client
To ensure that your client can access the Kafka instance, add the following rule to the security group configured for the instance.
Table 3 Security group rule Direction
Action
Protocol & Port
Source
Inbound
Allow
All
sg-53d4
Figure 2 Configuring the security group for the Kafka instance
Cross-VPC and DNAT-based Instance Access
Configure security group rules according to Table 4.
Public Access
Configure security group rules according to Table 5.
Connections FAQs
- How Do I Select and Configure a Security Group?
- Can I Access a Kafka Instance Over a Public Network?
- How Many Connection Addresses Does a Kafka Instance Have by Default?
- Do Kafka Instances Support Cross-Region Access?
- Do Kafka Instances Support Cross-VPC Access?
- Do Kafka Instances Support Cross-Subnet Access?
- Does DMS for Kafka Support Authentication with Kerberos?
- Does DMS for Kafka Support Password-Free Access?
- How Do I Obtain the Public Access Address After Public Access Is Enabled?
- Does DMS for Kafka Support Authentication on Clients by the Server?
- Can I Use PEM SSL Truststore When Connecting to a Kafka Instance with SASL_SSL Enabled?
- What Are the Differences Between JKS and CRT Certificates?
- Which TLS Version Does DMS for Kafka Support?
- Is There a Limit on the Number of Client Connections to a Kafka Instance?
- How Many Connections Are Allowed from Each IP Address?
- Can I Change the Private Network Addresses of a Kafka Instance?
- Is the Same SSL Certificate Used for Different Instances?
- Why Is It Not Recommended to Use a Sarama Client for Messaging?
Feedback
Was this page helpful?
Provide feedbackThank you very much for your feedback. We will continue working to improve the documentation.See the reply and handling status in My Cloud VOC.
For any further questions, feel free to contact us through the chatbot.
Chatbotmore