Configuring a Security Group Rule

Scenarios

• When you attempt to connect to an RDS DB instance through an EIP, you need to configure an inbound rule for the security group associated with the DB instance.
• When you attempt to connect to an RDS DB instance through a private network, check whether the ECS and DB instance are in the same security group.
  • If the ECS and RDS DB instance are in the same security group, they can communicate with each other by default. No security group rule needs to be configured.
  • If the ECS and RDS DB instance are in different security groups, you need to configure security group rules for them, separately.
    • RDS DB instance: Configure an inbound rule for the security group with which the RDS DB instance is associated.
    • ECS: The default security group rule allows all outgoing data packets. In this case, you do not need to configure a security group rule for the ECS. If not all outbound traffic is allowed in the security group, you need to configure an outbound rule for the ECS.

Precautions

• By default, you can create a maximum of 100 security groups in your cloud account.
• By default, you can add up to 50 security group rules to a security group.
• One RDS instance can be associated with multiple security groups, and one security group can be associated with multiple RDS instances.
• Too many security group rules will increase the first packet latency. You are advised to create no more than 50 rules for a security group.
• To access a DB instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the DB instance.

Procedure

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Click Service List. Under Database, click Relational Database Service.
4. On the Instances page, click the DB instance name to go to the Basic Information page.
5. In the Connection Information area, click the security group name.
6. On the Inbound Rules tab, click Add Rule to add an inbound rule. The following table lists the inbound rule parameters.

   You can click + to add more inbound rules.

   Table 1 Inbound rule parameter description

   Parameter	Description	Example Value
   Priority	Security group rule priority. Value range: 1 to 100. The default priority is 1 and has the highest priority. The security group rule with a smaller value has a higher priority.	1
   Action	Security group rule actions. A rule with a deny action overrides another with an allow action if the two rules have the same priority.	Allow
   Protocol & Port	Protocol: network protocol. Available options: ANY, TCP, UDP, and ICMP.	Custom TCP
   	Port: the port over which the traffic can reach your DB instance. RDS for MySQL instances can use database ports 1024 to 65535, excluding 12017, 33071, and 33062, which are reserved for RDS system use.	3306
   Type	IP address type. IPv4 IPv6	IPv4
   Source	Source address. It can be a single IP address, an IP address group, or a security group to allow access from them to your DB instance. Examples: Single IP address: 192.168.10.10/32 (IPv4 address) IP address segment: 192.168.1.0/24 (IPv4 address segment) All IP addresses: 0.0.0.0/0 (any IPv4 address) Security group: sg-abc IP address group: ipGroup-test	0.0.0.0/0
   Description	Supplementary information about the security group rule. This parameter is optional. The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).	N/A

7. Click OK.