Relational Database ServiceRelational Database Service

Elastic Cloud Server
Bare Metal Server
Auto Scaling
Image Management Service
Dedicated Host
Virtual Private Cloud
Elastic IP
Elastic Load Balance
NAT Gateway
Direct Connect
Virtual Private Network
Domain Name Service
VPC Endpoint
Cloud Connect
Enterprise Switch
Security & Compliance
Web Application Firewall
Host Security Service
Data Encryption Workshop
Database Security Service
Advanced Anti-DDoS
Data Security Center
Container Guard Service
Situation Awareness
Managed Threat Detection
Cloud Certificate Manager
Anti-DDoS Service
Relational Database Service
Document Database Service
Data Admin Service
Data Replication Service
GaussDB(for MySQL)
Distributed Database Middleware
GaussDB(for openGauss)
Developer Services
Distributed Cache Service
Simple Message Notification
Application Performance Management
Application Operations Management
API Gateway
Cloud Performance Test Service
Distributed Message Service for Kafka
Distributed Message Service for RabbitMQ
Distributed Message Service for RocketMQ
Cloud Service Engine
Cloud Communications
Message & SMS
Cloud Ecosystem
Partner Center
User Support
My Account
Billing Center
Cost Center
Resource Center
Enterprise Management
Service Tickets
HUAWEI CLOUD (International) FAQs
ICP License Service
Support Plans
Customer Operation Capabilities
Partner Support Plans
Professional Services
Intelligent EdgeFabric
SDK Developer Guide
API Request Signing Guide
Koo Command Line Interface
Updated at: Apr 02, 2022 GMT+08:00

Configuring Security Group Rules


A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted in a VPC.

This section describes how to create a security group to enable specific IP addresses and ports to access RDS.

When you attempt to connect to an RDS DB instance through an EIP, you need to configure an inbound rule for the security group associated with the DB instance.


The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are deployed in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

  • By default, you can create a maximum of 100 security groups in your cloud account.
  • By default, you can add up to 50 security group rules to a security group.
  • One RDS DB instance can be associated only with one security group.
  • Too many security group rules will increase the first packet latency. You are advised to create no more than 50 rules for each security group.
  • To enable access to an RDS DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the RDS DB instance.

To ensure security of data and DB instances, you are advised to use the principle of least privilege for database access. Change the database port (default value: 5432), and set the IP address to the remote server's address or any IP address in the remote server's smallest subnet to control the access scope of the remote server.

If you use, RDS DB instances in the security group can be accessed from any IP address.

For details about the requirements of security group rules, see the Adding a Security Group Rule section in the Virtual Private Cloud User Guide.


  1. Log in to the management console.
  2. Click in the upper left corner and select a region and a project.
  3. Click Service List. Under Database, click Relational Database Service. The RDS console is displayed.
  4. On the Instance Management page, click the target DB instance.
  5. Configure security group rules.

    In the Connection Information area, click the security group.
    Figure 1 Connection information

  6. On the inbound rule tab, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.

    You can click + to add more inbound rules.
    Figure 2 Adding an inbound rule
    Table 1 Inbound rule parameter description



    Example Value

    Protocol & Port

    Protocol: specifies the network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.

    Custom TCP

    Port: specifies the port or port range over which the traffic can reach your ECS.

    When connecting to the DB instance through a public network, enter the port of the target DB instance.


    Specifies the source of the security group rule. The value can be an IP address or a security group. For example:

    • (IPv4 address)
    • (subnet)
    • (any IP address)


    Provides supplementary information about the security group rule. This parameter is optional.

    The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).


Did you find this page helpful?

Failed to submit the feedback. Please try again later.

Which of the following issues have you encountered?

Please complete at least one feedback item.

Content most length 200 character

Content is empty.

OK Cancel