Help Center > > Getting Started> Getting Started with RDS for MySQL> Connecting to a DB Instance Through a Private Network> Step 2: Configure Security Group Rules

Step 2: Configure Security Group Rules

Updated at: May 26, 2020 GMT+08:00

Scenarios

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted in a VPC.

This section describes how to create a security group to enable specific IP addresses and ports to access RDS.

Check whether the ECS and RDS DB instance are in the same security group.

  • If the ECS and RDS DB instance are in the same security group, they can communicate with each other by default. No security group rule needs to be configured. Go to Step 3: Connect to a DB Instance Through a Private Network.
  • If the ECS and RDS DB instance are in different security groups, you need to configure security group rules for them, separately.
    • RDS DB instance: Configure an inbound rule for the security group with which the RDS DB instance is associated.
    • ECS: The default security group rule allows all outgoing data packets. In this case, you do not need to configure a security rule for the ECS. If not all outbound traffic is allowed in the security group, you need to configure an outbound rule for the ECS.

This section describes how to configure an inbound rule for an RDS DB instance.

For details about the requirements of security group rules, see the Adding a Security Group Rule section in the Virtual Private Cloud User Guide.

Precautions

The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are deployed in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

  • By default, you can create a maximum of 500 security group rules.
  • Too many security group rules will increase the first packet latency. You are advised to create a maximum of 50 rules for each security group.
  • To access an RDS DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the RDS DB instance.

To ensure security of data and DB instances, you are advised to use the principle of least privilege for database access. Change the database port (default value: 3306), and set the IP address to the remote server's address or any IP address in the remote server's smallest subnet to control the access scope of the remote server.

If you use 0.0.0.0/0, you enable all IP addresses to access RDS DB instances in the security group.

For details about the requirements of security group rules, see the Adding a Security Group Rule section in the Virtual Private Cloud User Guide.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner and select a region and a project.
  3. Click Service List. Under Database, click RDS. The RDS console is displayed.
  4. On the Instance Management page, click the target DB instance.
  5. Configure a security group rule.

    • In the Connection Information area on the Basic Information page, click the security group.
      Figure 1 Connection information
    • You can also choose Connection Management in the navigation pane on the left. In the Security Group Rules pane on the Private Connection page, click the security group name in the Security Group field. The Security Groups page is displayed.
      Figure 2 Security group rules
    • You can also choose Connection Management in the navigation pane on the left. In the Security Group Rules pane on the Private Connection page, click Allow All IP or Add Inbound Rule.

      Allow All IP allows all IP addresses to access RDS DB instances in the security group, which poses high security risks. Exercise caution when performing this operation.

  6. On the inbound rule tab, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.

    You can click + to add more inbound rules.
    Figure 3 Adding an inbound rule
    Table 1 Inbound rule parameter description

    Parameter

    Description

    Example Value

    Protocol & Port

    Specifies the network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.

    Custom TCP

    Port: specifies the port or port range over which the traffic can reach your ECS.

    When connecting to the DB instance through a private network, enter the port of the target DB instance.

    Source

    Specifies the source of the security group rule. The value can be another security group or a single IP address. For example:

    • xxx.xxx.xxx.xxx/32 (IPv4 address)
    • xxx.xxx.xxx.0/24 (subnet)
    • 0.0.0.0/0 (any IP address)

    0.0.0.0/0

    Description

    Provides supplementary information about the security group rule. This parameter is optional.

    The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).

    N/A

Did you find this page helpful?

Submit successfully!

Thank you for your feedback. Your feedback helps make our documentation better.

Failed to submit the feedback. Please try again later.

Which of the following issues have you encountered?







Please complete at least one feedback item.

Content most length 200 character

Content is empty.

OK Cancel