Configure security group rules

Use cases

After you create an ApsaraDB RDS for SQL Server instance, you cannot connect to it by default. You must configure an IP address whitelist or a security group to grant access. After the configuration is complete, access is granted to the IP addresses in the IP address whitelist, the ECS instances in the security group, and the custom authorized entities in the security group.

Usage notes

• You can add a maximum of 10 security groups to an instance. There is no limit on the number of security group rules.

• Changes to an associated security group take effect in real time.

• You can associate an ApsaraDB RDS instance only with security groups of the same network type. For example, if your instance is in a VPC, you can only add a security group that is also in a VPC. The same applies to the classic network.

  Note

  If you change the network type of an instance, its associated security groups become invalid. You must associate new security groups of the new network type.

Associate a security group

This procedure describes how to associate an ECS security group with an ApsaraDB RDS for SQL Server instance to allow all ECS instances within that security group to access the instance.

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Whitelist and SecGroup, and then click the Security Group tab.

3. Click Add Security Group (for a shared instance) or Associate Security Group Whitelist (for a general-purpose or dedicated instance), select the security group that you want to associate, and then click OK.

   Note

   Security groups marked with a VPC tag are located in a VPC.

Configure a security group rule

You can configure a security group rule for a specific authorization object to allow specific entities to access your ApsaraDB RDS for SQL Server instance or other services, such as SQL Server Analysis Services (SSAS) and SQL Server Reporting Services (SSRS).

1. Go to the Instances page. In the top navigation bar, select the region in which the RDS instance resides. Then, find the RDS instance and click the ID of the instance.

2. In the left-side navigation pane, click Whitelist and SecGroup, and then click the Security Group tab.

3. Click Add Security Group Rule, select an add type and configure the security group rule, and then click OK.

   Note

   Instances within the same VPC share the same security group. Modifying a security group for one instance affects all other instances in that VPC.

   Type	Description
   Scenario-based Addition	Provides templates for the following two scenarios: SQL Server Analysis Services (SSAS): The default protocol type is TCP, the port range is 2383/2383, and the authorization object is 0.0.0.0/0. SQL Server Reporting Services (SSRS): The default protocol type is TCP, the port range is 443/443, and the authorization object is 0.0.0.0/0. Important Using 0.0.0.0/0 as the authorization object allows access from all IP addresses. To avoid security risks, we recommend that you replace it with a specific CIDR block as soon as possible in your production environment.
   Manually Add	Configure the parameters for the security group rule: Protocol type: Specifies the protocol. TCP and UDP are supported. For more information, see Security group rules. Port range: Specifies the destination port range for inbound traffic, such as 22/22. For more information, see Common ports. Authorization object: Specifies the source IP address or CIDR block to authorize, such as 192.0.2.100. Description: An optional description for the rule.

Related operations

References

• You can also configure an IP address whitelist to allow other devices to access your ApsaraDB RDS instance. For more information, see Configure an IP address whitelist.

• After you configure a security group or an IP address whitelist, you can create databases and accounts. For more information, see Create a database and an account.

• For security group-related API operations, see the following topics:

  • Query the association information of an ApsaraDB RDS instance and an ECS security group

  • Modify the association information of an ApsaraDB RDS instance and an ECS security group

  • Add a security group rule

  • View security group rules

  • Modify a security group rule

  • Delete a security group rule