Elastic Compute Service:Security groups for different use cases

Take note of the following items about security group rules:

• By default, security groups deny all inbound access.

• By default, basic security groups allow all outbound access.

• By default, ECS instances in different security groups are isolated from each other over the internal network.

• In security groups of the Virtual Private Cloud (VPC) type, each rule controls access to or from the Internet and the internal network. You can configure a security group rule to deny or allow traffic to or from the Internet and the internal network.

• In security groups of the classic network type, public rules (Internet ingress and Internet egress rules) control access to or from the Internet, whereas internal rules (inbound and outbound rules) control access to or from the internal network.

• All sample security group rules described in this topic are configured for the default ports used by typical applications. Applications deployed on ECS instances use ports of the instances to provide external services. For more information, see Common ports.

For a website server that allows access from the Internet, you can configure security group rules to allow inbound traffic from any source only on TCP ports 80 (HTTP) and 443 (HTTPS). This ensures that the website can be accessed from the Internet, but restricts direct access to other services on the server.

The following table describes a sample security group rule.

To connect to an ECS instance, open a port for the connection protocol. For example, open TCP port 22 (SSH) or a custom SSH port. To reduce the risk of malicious attacks, configure security group rules to limit the authorization objects that are allowed to access the port of the connection protocol to specific users such as the administrator or the IP addresses of specific servers.

The following table describes a sample security group rule.

When you use Alibaba Cloud Workbench to connect to an ECS instance, you need to only allow specific authorization objects. The following table describes a sample inbound security group rule.

If you want to share data between ECS instances from different security groups within the same VPC, such as when you want instances in Security Group A to access shared files on instances in Security Group B over FTP, you can add rules to allow mutual access between the security groups over the internal network. The preceding method is more convenient than adding rules to allow access to or from individual IP addresses or CIDR blocks. You do not need to separately configure access control for each instance in each security group.

In most cases, databases require strict security policies. You can configure security group rules to allow inbound connections only on specific ports from specific IP addresses or security groups, such as the security group to which an application server belongs. This ensures the privacy and security of database access.

The following table describes sample security group rules for common databases that use the corresponding default ports.

You may need to restrict specific network protocols based on your business requirements. For example, you may need to allow traffic over only specific ports of TCP or UDP. The Internet Control Message Protocol (ICMP) is used to transfer control messages between IP hosts and routers. Before you can perform specific test operations, such as running the ping command on a client to ping your ECS instance, you must add security group rules to allow inbound ICMP access. The following table describes a sample security group rule.

By default, basic security groups allow all outbound access. To allow ECS instances in a basic security group to access only specific websites, you can use the security group as a whitelist and add a Deny rule that denies all outbound access and then Allow rules that allow outbound access to the IP addresses of the websites.

The following table describes the sample security group rules.

The preceding rules indicate that the ECS instances in the security group are allowed to access the HTTP service at 47.96.XX.XX on port 80 and the HTTPS service at 121.199.XX.XX on port 443. Other outbound access requests are denied.