Updated on 2025-08-28 GMT+08:00

Creating a Security Group

Scenarios

A security group is a collection of access control rules for ECSs that have the same security protection requirements and are mutually trusted. It controls the traffic that flows in and out of ECSs. This section describes how to create a security group.

Security groups are commonly used to allow or deny network traffic from specific sources or over specific protocols, block certain ports, and define specific access permissions for instances.

When creating an ECS, you must associate it with a security group. If no security group has been created yet, a default security group will be automatically created and associated with the ECS. You can also create a security group and add inbound and outbound rules to allow specific traffic. For more information about security groups, see Overview.

Security Group Template

When creating a security group, you can select a template. The templates have preset inbound and outbound rules. You can select one as needed to quickly create a security group. Table 1 describes the security group template parameters.

Table 1 Security group template parameters

Template

Direction

Protocol & Port

Source/Destination

Description

Scenario

General-purpose web server

Inbound rules

TCP: 22 (IPv4)

0.0.0.0/0

Allows all IPv4 addresses to access instances in the security group over port 22 (SSH) for remotely logging in to Linux instances.

  • Remotely log in to an instance (such as an ECS) in a security group from a public network.
  • Enable external servers to ping the instances in a security group to verify network connectivity.
  • Use instances in a security group as web servers to provide website services accessible from the public network.

TCP: 3389 (IPv4)

0.0.0.0/0

Allows all IPv4 addresses to access instances in a security group over port 3389 (RDP) for remotely logging in to Windows instances.

TCP: 80 (IPv4)

0.0.0.0/0

Allows all IPv4 addresses to access instances in a security group over port 80 (HTTP) for visiting websites.

TCP: 443 (IPv4)

0.0.0.0/0

Allows all IPv4 addresses to access instances in a security group over port 443 (HTTPS) for visiting websites.

ICMP: All (IPv4)

0.0.0.0/0

Allows all IPv4 addresses to access instances in a security group over any port for using the ping command to test connectivity.

All (IPv4)

Current security group

Allows the instances in a security group to communicate with each other over a private network over any protocol and port.

All (IPv6)

Outbound rules

All (IPv4)

0.0.0.0/0

Allows all traffic from the instances in the security group to external resources over any protocol and port.

All (IPv6)

::/0

All ports open

Inbound Rules

All (IPv4)

0.0.0.0/0

Allows any IP address to access the instances in a security group over any protocol and port.

Allow any traffic to enter and leave a security group over any port. This operation has security risks.

All (IPv6)

::/0

All (IPv4)

Current security group

Allows the instances in a security group to communicate with each other over a private network over any protocol and port.

All (IPv6)

Outbound rules

All (IPv4)

0.0.0.0/0

Allows all traffic from the instances in the security group to external resources over any protocol and port.

All (IPv6)

::/0

Custom

Inbound rules

All (IPv4)

Current security group

Allows the instances in a security group to communicate with each other over a private network over any protocol and port.

Deny any external traffic to the instances in a security group. You can add security group rules as required.

All (IPv6)

Outbound rules

All (IPv4)

0.0.0.0/0

Allows all traffic from the instances in the security group to external resources over any protocol and port.

All (IPv6)

::/0

Procedure

  1. Log in to the management console and access the Security Groups page.
  2. In the upper right corner, click Create Security Group.

    The Create Security Group page is displayed.

  3. Configure basic parameters in the Summary area.
    Figure 1 Configuring basic parameters
    Table 2 Basic parameters

    Parameter

    Description

    Example Value

    Region

    Mandatory

    The region where the security group belongs. Select the region nearest to you to ensure the lowest latency possible.

    An instance must be in the same region as its associated security group.

    CN-Hong Kong

    Name

    Mandatory

    A security group name. The name can contain:
    • 1 to 64 characters
    • Only letters, digits, underscores (_), hyphens (-), and periods (.)
    NOTE:

    You can change the security group name after a security group is created. It is recommended that you give each security group a different name.

    sg-AB

    Enterprise Project

    Mandatory

    When creating a security group, you can add the security group to an enabled enterprise project.

    An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default.

    For details about creating and managing enterprise projects, see the Enterprise Management User Guide.

    default

    Tag

    Tag (Optional)

    You can add tags to the security group. Tags help you to identify, classify, and search for your security groups.

    For details, see Overview.

    Tag key: test

    Tag value: 01

    Description (Optional)

    Optional

    Supplementary information about the security group.

    The security group description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).

    N/A

  4. In the Manage Rules area, configure security group rules as instructed.
    1. Select a template.
      Figure 2 Managing rules
      Table 3 Template parameters

      Parameter

      Description

      Example Value

      Template

      Mandatory

      There are three templates preset with different inbound and outbound rules for you to select.

      • General-purpose web server (default value): The security group that you create using this template is for general-purpose web servers and includes default rules that allow all inbound ICMP traffic and allow inbound traffic on ports 22, 80, 443, and 3389.
      • All ports open: Inbound traffic on any port is allowed. This poses security risks, so exercise caution when selecting this template.
      • Custom: No port is allowed. You need to customize security group rules.

      For details about template parameters and scenarios, see Table 1.

      General-purpose web server

    2. Modify security group rules.
      If the preset rules in templates cannot meet service requirements, you can add security group rules or delete or modify preset rules.
      • For details about inbound rule parameters, see Table 6. For details about outbound rule parameters, see Table 7.
      • If the source of an inbound rule is set to the current security group, you cannot delete this rule. Doing so will prevent instances in the security group from communicating with each other.
      • If the destination of an outbound rule is set to 0.0.0.0/0 or ::/0, you cannot delete this rule. Doing so will prevent instances in the security group from accessing external networks.
  5. Click Create Now.
  6. Go to the Security Groups page of the ECS and click the security group name to view the security group details.