Creating a Security Group

Scenarios

A security group consists of inbound and outbound rules. You can add security group rules to allow or deny the traffic to reach and leave the instances (such as ECSs) in the security group.

When creating an instance (for example, an ECS), you must associate it with a security group. If no security group has been created yet, a default security group will be created and associated with the instance. You can also create a security group and add inbound and outbound rules to allow specific traffic. For more information about security groups and rules, see Security Group and Security Group Rule Overview.

Preset Security Group Rules

When creating a security group, you can select preset rules. The preset rules have preconfigured inbound and outbound rules. You can select rules as needed. Table 1 describes the preset rules.

Procedure

1. Go to the security group list page.
2. In the upper right corner, click Create Security Group.

   The Create Security Group page is displayed.

3. Configure the parameters as prompted.
   Figure 1 Create Security Group
   

   Table 2 Parameter description

   Parameter	Description	Example Value
   Region	Mandatory The region where the security group belongs. Select the region nearest to you to ensure the lowest latency possible. An instance must be in the same region as its associated security group.	CN-Hong Kong
   Name	Mandatory The name of the security group. The name: Can contain 1 to 64 characters. Can contain letters, digits, underscores (_), hyphens (-), and periods (.). NOTE: You can change the security group name after a security group is created. It is recommended that you give each security group a different name.	sg-AB
   Enterprise Project	Mandatory When creating a security group, you can add the security group to an enabled enterprise project. An enterprise project facilitates project-level management and grouping of cloud resources and users. The name of the default project is default. For details about creating and managing enterprise projects, see the Enterprise Management User Guide.	default
   Tag	Tag (Optional) You can add tags to the security group. Tags help you to identify, classify, and search for your security groups. For details, see Managing Security Group Tags.	Tag key: test Tag value: 01
   Description (Optional)	Optional Supplementary information about the security group. The security group description can contain a maximum of 255 characters and cannot contain angle brackets (< or >).	N/A
   Preset Rule	Mandatory The preset rules have preconfigured inbound and outbound rules. You can select rules as needed. For details about preset security group rules and their application scenarios, see Table 1.	General-purpose web server

4. Check the preset rules and do the following as required:
   • Add rules.
   • Replicate rules.
   • Modify rules.
   • Delete rules.
     

     • For details about inbound rule parameters, see Table 2. For details about outbound rule parameters, see Table 3.
     • If the source of an inbound rule is set to the current security group, you cannot delete this rule. Doing so will prevent instances in the security group from communicating with each other.
     • If the destination of an outbound rule is set to 0.0.0.0/0 or ::/0, you cannot delete this rule. Doing so will prevent instances in the security group from accessing external networks.

Follow-Up Operations

Each cloud server must be associated with at least one security group. You can add a cloud server to multiple security groups based on service requirements. For details, see Adding an Instance to or Removing an Instance from a Security Group.