Adding ECSs to Security Groups

Scenarios

You can add an ECS to a security group by associating its network interface with that security group. After the association is successful, the security group controls the inbound and outbound traffic of the ECS. You can change the association between the ECS network interface and the security group as needed. An ECS can be added to multiple security groups. Traffic is matched against the rules of these security groups in order of priority. For details, see How Traffic Matches Security Group Rules.

This section describes how to associate network interfaces of ECSs with security groups.

Constraints

• Adding an ECS to a new security group does not affect the settings of the security groups that the ECS has been associated with.
• Using multiple security groups may deteriorate ECS network performance. You are advised to select no more than five security groups.
• When adding multiple ECSs to security groups, you can only associate their primary network interfaces with the security groups.

Adding an Individual ECS to Security Groups

1. Log in to the ECS console and access the ECS list page.
2. In the ECS list, choose More > Manage Network > Add to Security Group in the Operation column.

   The Add to Security Group dialog box is displayed.

3. Select a network interface and one or more security groups.

   Table 1 Parameters for adding an ECS to security groups

   Parameter	Description
   Network Interface	This parameter is mandatory. The network interfaces attached to the ECS are displayed in the drop-down list. Select the target network interface to associate with security groups.
   Security Group	This parameter is mandatory. All security groups that can be associated are displayed in the drop-down list. If there are no available security groups, click Create Security Group. You can select multiple security groups at a time. They are sorted in the order in which they are selected. Traffic is matched based on the priority of security groups in descending order. A security group with a smaller sequence number has a higher priority. For details about traffic matching rules, see How Traffic Matches Security Group Rules. NOTE: If the selected security group has already been associated with the ECS, the security group will not be added again and its priority in the security group list remains unchanged. Using multiple security groups may deteriorate ECS network performance. You are advised to select no more than five security groups.
   Place Security Group At	If you select Top, the selected security groups will be placed at the top of the list and have the highest priority. If you select Bottom, the selected security groups will be placed at the bottom of the list and have the lowest priority.
   Security Group Rules	The rules of the selected security groups are displayed here. You can expand to view the selected security groups and their rules or hide them. Selected security groups: The selected security groups are displayed here. Security group rules: The inbound and outbound rules of the selected security groups are displayed here.

4. Click OK.

   Go to the ECS details page to view the associated security groups. For details, see Viewing Security Groups Associated with an ECS.

Adding Multiple ECSs to Security Groups

1. Log in to the ECS console and access the ECS list page.
2. Select the ECSs you want to add to one or more security groups.
3. Choose More > Manage Security Group > Add to Security Group above the ECS list.

   The Add to Security Group panel slides out from the right.

4. Select one or more security groups to associate with the primary network interfaces of the selected ECSs.

   Table 2 Parameters for adding multiple ECSs to security groups

   Parameter	Description
   Security Group	This parameter is mandatory. All security groups that can be associated are displayed in the drop-down list. If there are no available security groups, click Create Security Group. You can select multiple security groups at a time. They are sorted in the order in which they are selected. Traffic is matched based on the priority of security groups in descending order. A security group with a smaller sequence number has a higher priority. For details about traffic matching rules, see How Traffic Matches Security Group Rules. NOTE: If the selected security group has already been associated with the ECS, the security group will not be added again and its priority in the security group list remains unchanged. Using multiple security groups may deteriorate ECS network performance. You are advised to select no more than five security groups.
   Place Security Group At	If you select Top, the selected security groups will be placed at the top of the list and have the highest priority. If you select Bottom, the selected security groups will be placed at the bottom of the list and have the lowest priority.
   Security Group Rules	The rules of the selected security groups are displayed here. You can expand to view the selected security groups and their rules or hide them. Selected security groups: The selected security groups are displayed here. Security group rules: The inbound and outbound rules of the selected security groups are displayed here.

5. Click OK.

   Go to the ECS details page to view the associated security groups. For details, see Viewing Security Groups Associated with an ECS.

Viewing Security Groups Associated with an ECS

1. Log in to the ECS console and access the ECS list page.
2. Click the target ECS name to go to the details page.
3. Click the Security Groups tab.
4. Select a network interface from the drop-down list to view all the associated security groups and security group rules.