A security group is a virtual firewall that controls inbound and outbound network traffic for ENS instances to isolate workloads. You can configure security group rules to allow or deny inbound and outbound traffic for instances within the security group.
Overview
A security group is an instance-level network access control feature provided by ENS. You can add ENS instances that share the same security requirements to the same security group and use security group rules to manage their network traffic in a unified way. Security groups provide the following capabilities:
-
Inbound and outbound traffic control: Control inbound traffic (from external sources to an instance) and outbound traffic (from an instance to external destinations) by using security group rules.
-
Protocol and port filtering: Filter traffic by protocol type, such as TCP, UDP, and ICMP, and by port range.
-
IPv4/IPv6 dual-stack support: The source and destination in security group rules support both IPv4 and IPv6 address ranges, meeting access control requirements in IPv6 scenarios.
-
Immediate effect: Changes to security group rules take effect immediately for all instances in the group without requiring an instance restart.
Security groups are a free feature and currently support X86 compute-optimized and ARM compute-optimized instance types.
Security group architecture
A security group operates at the network interface level of an ENS instance, controlling traffic for public and internal network interfaces separately.
After an instance is associated with a security group, the security group rules apply to the public network interface if the instance has one. If the instance has only an internal network interface, the rules apply to the primary network interface.
A security group applies to the network interface of an ENS instance to filter traffic. The preceding diagram illustrates the default behavior of a security group with no custom rules:
-
Public network interface: The security group controls inbound traffic from the internet and outbound traffic from the instance to the internet.
-
Internal network interface: The security group controls east-west traffic between instances inside a VPC. Security group rules also control traffic routed to the internet through NAT.
Security group rules
A security group rule is the fundamental unit for controlling traffic within a security group. Each rule defines a set of traffic matching conditions and a corresponding policy.
Rule components
A security group rule consists of the following elements:
|
Element |
Description |
|
Direction |
The direction of traffic, which can be inbound or outbound. Inbound rules control traffic from external sources to the instance. Outbound rules control traffic from the instance to external destinations. |
|
Action |
The action to take on matching traffic, which can be Allow or Deny. When traffic matches the rule, it is either allowed or dropped. |
|
Protocol type |
Supported protocols include TCP, UDP, ICMP (IPv4), ICMPv6 (IPv6), GRE, and ALL (all protocols). |
|
Port range |
The destination port range for the traffic. The format is |
|
Source/destination |
The source of traffic for an inbound rule or the destination of traffic for an outbound rule. You can specify a single IP address (for example,
|
|
Priority |
A value from 1 to 100. A smaller value indicates a higher priority. |
Default security group rules
When you create a new security group, the system adds the following default access control policies:
|
Direction |
Default policy |
Description |
|
Inbound |
Deny all traffic |
All inbound traffic is denied by default. You must add allow rules to enable external access to instances with a public network interface and to enable communication between instances with an internal network interface. |
|
Outbound |
Allow all traffic |
All outbound traffic is allowed by default. |
(After April 7, 2024) New security groups deny all inbound traffic by default. If you cannot access an instance after adding it to a new security group, check whether you have added the necessary inbound allow rules.
The following table compares the default behavior of ENS security groups with that of ECS security groups in central regions:
|
Item |
ENS security group |
ECS security group (regular) |
|
Default inbound policy |
Deny all traffic |
Deny all traffic (communication between instances in the same security group is allowed) |
|
Default outbound policy |
Allow all traffic |
Allow all traffic |
Rule evaluation order
When an instance receives network traffic, the system evaluates security group rules in the following order:
-
The system aggregates all rules of the same direction from the security groups associated with the instance.
-
The system sorts the rules by priority from highest to lowest (1 to 100). If two rules have the same priority, the deny rule takes precedence over the allow rule.
-
The system evaluates the rules in order. It applies the first rule that matches the traffic and ignores subsequent rules.
-
If no rule matches the traffic, the system applies the default policy: deny inbound traffic and allow outbound traffic.
Stateful nature
ENS security group rules are stateful. This means that if inbound traffic is allowed, its corresponding outbound response is also automatically allowed, regardless of any outbound rules. Conversely, if inbound traffic is denied, its outbound response is also denied.
Manage security groups
You can perform the following management operations on security groups in the ENS console.
Create a security group
By default, a new security group contains no inbound allow rules. Add rules as needed.
-
Go to the ENS security group management page.
-
Click Create Security Group.
-
On the Create Security Group page, configure the following parameters and click Create:
-
Name: A custom name for the security group for easy identification and management, such as
Security-Group. -
Access Rule: You can define security group rules during creation, or add and manage them later.
NoteYou do not need to specify a VPC when you create an ENS security group. You can add instances from different ENS nodes and VPCs to the same security group.
-
Add a security group rule
-
In the security group list, find the target security group, and click the security group ID or Manage in the Actions column.
-
Select the Inbound or Outbound tab as needed.
-
Click Add, and configure the rule's Authorization Policy, Priority, Protocol Type, Port Range, and Authorization Object.
-
Click OK.
The following table provides rule configuration examples for common business scenarios.
|
Scenario |
Direction |
Protocol type |
Port range |
Source |
Action |
|
Allow SSH remote connections |
Inbound |
TCP |
|
A specific IP address or |
Allow |
|
Allow RDP remote connections |
Inbound |
TCP |
|
A specific IP address or |
Allow |
|
Allow HTTP access |
Inbound |
TCP |
|
|
Allow |
|
Allow HTTPS access |
Inbound |
TCP |
|
|
Allow |
|
Allow ping requests |
Inbound |
ICMP |
|
|
Allow |
|
Allow communication between instances in a VPC |
Inbound |
ALL |
|
VPC CIDR block |
Allow |
As a security best practice, grant access to SSH (port 22) and RDP (port 3389) only from trusted IP addresses. Avoid using 0.0.0.0/0, which allows access from any source.
Modify a security group rule
-
In the list of security group rules, find the target rule, and click Manage in the Actions column.
-
After you modify the rule parameters, click Save.
Delete a security group rule
-
In the list of security group rules, find the target rule, and click Delete in the Actions column.
-
In the confirmation dialog box, click OK.
Deleting a rule takes effect immediately and may affect the network connectivity of your instances. Proceed with caution.
Associate an instance with a security group
When you create an ENS instance, you must associate it with a security group. For existing instances, you can also change their security group associations as follows:
-
In the ENS instance list, find the target instance and click its ID to go to the instance details page.
-
Select the Security Group tab to add the instance to or remove it from a security group.
Delete a security group
-
In the security group list, find the target security group, and click Delete in the Actions column.
-
In the confirmation dialog box, click OK.
Before you delete a security group, ensure that no instances are associated with it. You cannot delete a security group that has associated instances.
Limitations
|
Item |
Limit |
|
Supported instance types |
X86 compute-optimized, ARM compute-optimized |
|
Maximum number of security groups per account |
100 |
|
Number of rules per security group |
Up to 200 inbound and outbound rules in total |
|
Number of security groups per instance |
Up to 5 |
Best practices
-
Follow the principle of least privilege: Open only the protocols and ports required by your services. For example, if you only need to provide web services, allow traffic only on ports 80 and 443.
-
Restrict access to management ports: Restrict access to management ports such as SSH (22) and RDP (3389) to trusted IP addresses used by your operations team. Avoid opening these ports to
0.0.0.0/0. -
Add inbound rules promptly: By default, new security groups deny all inbound traffic. After creating a security group, add the necessary allow rules.
-
Organize security groups by business role: Create different security groups for different business roles, such as web servers and database servers. This practice simplifies rule configuration and management.
-
Keep rules concise: Avoid configuring an excessive number of rules in a single security group to ensure clarity and maintainability.
-
Configure IPv6 rules: If your instance uses an IPv6 address, configure security group rules for IPv6 address ranges to ensure that IPv6 traffic control works as expected.
Security groups vs. network ACLs
Both security groups and network ACLs are network access control features provided by ENS, but they differ in scope and behavior:
|
Item |
Security group |
Network ACL |
|
Scope |
Instance level (network interface) |
VPC network level |
|
Statefulness |
Stateful (automatically allows response traffic) |
Stateful or stateless, depending on the protocol. For more information, see the Rule evaluation mechanism section in Network ACLs. |
|
Rule targets |
Associated instances |
All instances and elastic network interfaces in the VPC |
|
Default behavior |
Denies inbound traffic, allows outbound traffic |
Includes default allow rules upon creation |
|
Use cases |
Fine-grained traffic control for a single instance or a group of instances |
Boundary access control for an entire VPC network |
Use both security groups and network ACLs to implement a multi-layered network security defense.