Help Center/ Relational Database Service/ User Guide (Kuala Lumpur Region)/ Getting Started with RDS for MySQL/ Step 2: Connect to a DB Instance/ Connecting to a DB Instance Through a Public Network/ Configuring Security Group Rules
Updated on 2022-08-16 GMT+08:00
View PDF
Share

Configuring Security Group Rules

Scenarios

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted in a VPC.

This section describes how to create a security group to enable specific IP addresses and ports to access RDS.

When you attempt to connect to an RDS DB instance through an EIP, you need to configure an inbound rule for the security group associated with the DB instance.

Precautions

The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are deployed in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

  • By default, a tenant can create a maximum of 100 security groups.
  • By default, each security group can have a maximum of 50 security group rules.
  • One security group can be associated with only one RDS DB instance.
  • Too many security group rules will increase the first packet latency. You are advised to create no more than 50 rules for each security group.
  • To enable access to an RDS DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the RDS DB instance.

If you use 0.0.0.0/0, RDS DB instances in the security group can be accessed from any IP address.

Procedure

  1. Log in to the management console.
  2. Click in the upper left corner and select a region and a project.
  3. On the Instance Management page, click the target DB instance.
  4. Configure security group rules.

    • In the Connection Information area on the Basic Information page, click the security group.
      Figure 1 Connection information

  5. On the inbound rule tab, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.

    You can click + to add more inbound rules.
    Figure 2 Adding an inbound rule
    Table 1 Inbound rule parameter description

    Parameter

    Description

    Example Value

    Protocol & Port

    Protocol: specifies the network protocol. Currently, the value can be All, TCP, UDP, ICMP, GRE, or others.

    Custom TCP

    Port: specifies the port or port range over which the traffic can reach your ECS.

    When connecting to the DB instance through a public network, enter the port of the target DB instance.

    Source

    Specifies the source of the security group rule. The value can be an IP address or a security group. For example:

    • xxx.xxx.xxx.xxx/32 (IPv4 address)
    • xxx.xxx.xxx.0/24 (subnet)
    • 0.0.0.0/0 (any IP address)

    0.0.0.0/0

    Description

    Provides supplementary information about the security group rule. This parameter is optional.

    The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).

    -