Learn about and manage managed security groups and related permissions on API operations-阿里云帮助中心

Managed security groups protect shared cloud resources from misoperation that may cause failures or security risks.

Background

A managed security group is a security group created in managed mode to resolve permission control issues in cloud services such as Network Load Balancer (NLB), Secure Access Service Edge (SASE), and API Gateway. These security groups are managed by cloud service systems. You can view them but cannot perform operations on them.

Note

Cloud services use STS to assume RAM roles of your account to create managed security groups. See What is Security Token Service (STS)?

In the console, you can view managed security groups but cannot modify them.
Only query API operations are supported for managed security groups. Other API operations return the InvalidOperation.ResourceManagedByCloudProduct error code. See Permissions on API operations related to managed security groups.

To identify a managed security group, call DescribeSecurityGroups and check whether ServiceManaged is True, or check whether the console displays You cannot modify security groups managed by cloud services.

Lifecycle of managed security groups

Managed security groups are bound to the lifecycle of the cloud service instances that create them.

Automatic creation: When you create a cloud service instance (such as an NLB instance or an API Gateway instance), the system automatically creates a managed security group in the VPC associated with the instance.
Deletion restriction: You cannot delete a managed security group directly. If you call the DeleteSecurityGroup API operation on a managed security group, the InvalidOperation.ResourceManagedByCloudProduct error code is returned.
Automatic cleanup: After you release the cloud service instance that originally created the managed security group, the system automatically cleans up the managed security group. The cleanup typically completes within 30 seconds after the instance is released.
VPC deletion: If you want to delete a VPC that contains a managed security group, you must first release the cloud service instance that created the managed security group, and then wait for the system to automatically clean up the managed security group. After the cleanup is complete, you can delete the VPC.

API operation permissions

In the following table, × indicates not supported and √ indicates supported.

API operation	Description	Alibaba Cloud account	Cloud service system
AuthorizeSecurityGroup	Adds an inbound rule to a security group. Adds an inbound rule that references a managed security group as the source.	×	√
AuthorizeSecurityGroupEgress	Adds an outbound rule to a security group. Adds an outbound rule that references a managed security group as the destination.	×	√
RevokeSecurityGroup	Deletes an inbound rule from a security group.	×	√
RevokeSecurityGroupEgress	Deletes an outbound rule from a security group.	×	√
JoinSecurityGroup	Adds a resource to a security group.	×	√
LeaveSecurityGroup	Removes a resource from a security group.	×	√
DeleteSecurityGroup	Deletes a security group.	×	√
ModifySecurityGroupAttribute	Modifies a security group.	×	√
ModifySecurityGroupRule	Modifies an inbound rule of a security group.	×	√
ModifySecurityGroupEgressRule	Modifies an outbound rule of a security group.	×	√
ModifySecurityGroupPolicy	Modifies the internal access control policy of a basic security group.	×	√
DescribeSecurityGroupAttribute	Queries security group rules.	√	√
DescribeSecurityGroups	Queries security groups.	√	√
DescribeSecurityGroupReferences	Queries security groups referenced by other security group rules.	√	√
CreateNetworkInterface	Creates an ENI.	×	√
ModifyNetworkInterfaceAttribute	Modifies an ENI.	×	√
RunInstances	Creates multiple instances in a batch.	×	√
CreateInstance	Creates an instance.	×	√
ModifyInstanceAttribute	Modifies the security group membership of an instance.	×	√