Manage security group rules efficiently using prefix lists-Elastic Compute Service(ECS)-阿里云帮助中心

A prefix list is a collection of network prefixes (CIDR blocks), and a port list is a collection of ports. You can reference prefix lists and port lists when you configure security group rules. Modifying the entries of a prefix list or port list is equivalent to directly modifying the security group rules. This helps you avoid maintaining multiple security group rules that differ only in their authorized IP addresses and port ranges. This topic describes how to use prefix lists and port lists to efficiently manage security group rules.

Scenarios

To secure your cloud resources, you may divide them into multiple security zones, with each zone corresponding to a security group. If a common source, such as your on-premises office network, needs to access resources across these zones, managing access can be challenging, especially if the IP addresses of that common source change frequently.

Each time the source IP addresses change, you must manually update the rules in every security group. The more security groups and IP addresses you have, the more complex and time-consuming this task becomes.

To address this, you can group the source IP addresses into a prefix list and the service ports into a port list. You can then reference these lists when you configure your security group rules. When IP addresses or ports change, you only need to modify the entries in the lists, not the rules in each security group. This greatly reduces management complexity and improves efficiency.

For example, to authorize a new IP address for 50 security groups, you would typically perform 50 separate operations. By using a prefix list, you can add the IP address to the list in a single operation.

If your cloud resources are distributed across multiple Alibaba Cloud regions, you can use the clone feature to copy an existing prefix list or port list to other regions.

Procedure

This procedure shows how to use a prefix list and a port list to control access to services on an ECS instance. In this example, we allow access from two CIDR blocks to two ports and then modify the access permissions.

Create a prefix list.
1. Go to ECS Console - Prefix List.
2. In the upper-left corner of the page, select a region and resource group.
3. On the Prefix Lists tab, click Create Prefix List.
4. In the Create Prefix List dialog box, configure the parameters and click OK.
  This example uses a prefix list that includes two IPv4 entries. The following parameters are for reference:
  - Prefix List Name: RemoteAccess-IP
  - Description: Allows the IP addresses in this list to access specific ECS instances.
  - Address Family: IPv4
  - Max Entries: 2
    
    Note
    When an associated resource, such as a security group, calculates its rule quota, it uses the Max Entries value, not the actual number of entries. Set this parameter to a reasonable value.
  - Prefix List Entries: Click Add Entry to add 192.168.1.0/24 and 192.168.2.0/24.
Create a port list.
1. On the Port Lists tab, click Create Port List.
2. In the Create Port List dialog box, configure the parameters and click OK.
  This example uses a port list that includes two port entries. The following parameters are for reference:
  - Port List Name: RemoteAccess-Port
  - Description: Specifies the service ports on ECS instances that can be accessed.
  - Max Entries: 2
    
    Note
    When an associated resource, such as a security group, calculates its rule quota, it uses the Max Entries value, not the actual number of entries. Set this parameter to a reasonable value.
  - Port List Entries: Click Add Entry to add 20000/20000 and 20008/20008. This example assumes that the services on the ECS instance use ports 20000 and 20008.
Use the prefix list and port list in a security group rule.

Repeat the following steps to add a security group rule to multiple security groups. Set the source to the RemoteAccess-IP prefix list and the destination to the RemoteAccess-Port port list.
1. Go to ECS Console - Security Group.
2. Find the target security group and click Manage Rules in the Operation column.
3. On the Inbound tab, click Add Rule.
  
  Note
  This example uses a security group for a VPC.
4. Configure the security group rule parameters and click Save.
  The following example parameters allow access to services on instances in the security group.
  - Authorization Policy: Allow
  - Priority: 1
  - Protocol Type: Custom TCP
  - Source: Select the prefix list RemoteAccess-IP.
  - Destination: Select the port list RemoteAccess-Port.
  After you add the rule, the security group allows inbound traffic from the IP addresses in the prefix list to the ports in the port list.
Modify the entries in the prefix list and port list.

If the authorized IP addresses or service ports change, you only need to modify the entries in the RemoteAccess-IP prefix list and the RemoteAccess-Port port list, rather than modifying the rules in each security group. For example, if the authorized private IP CIDR blocks change to 192.168.3.0/24 and 192.168.4.0/24, and the service ports change to 30000 and 30008, perform the following steps to modify the entries.
1. Go to ECS Console - Prefix List.
2. On the Prefix Lists tab, find the prefix list RemoteAccess-IP and click Details in the Operation column.
3. Click the Entries tab.
4. Find a prefix list entry and click Modify in the Operation column.
5. Set the CIDR Block parameter and click Save.
  
  Modify the two existing entries. Set their CIDR Block parameters to 192.168.3.0/24 and 192.168.4.0/24 respectively.
6. On the Port Lists tab, find the port list RemoteAccess-Port and click Details in the Operation column.
7. Click the Port List Entries tab.
8. Find a port list entry and click Modify in the Operation column.
9. Set the Port Range parameter and click Save.
  
  Modify the two existing entries. Set their Port Range parameters to 30000/30000 and 30008/30008 respectively.

Changes to prefix list or port list entries automatically apply to all security group rules that reference them.