Configuring Security Group Rules

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted within a VPC.

Before you can connect to your DB instance, you need to create security group rules to enable specific IP addresses and ports to access your RDS instance.

• When you attempt to connect to an RDS DB instance through an EIP, you need to configure an inbound rule for the security group associated with the RDS DB instance.
• When you attempt to connect to an RDS DB instance through a private network, check whether the ECS and DB instance are in the same security group.
  • If they are in the same security group, they can communicate with each other by default. No security group rules need to be configured.
  • If they are in different security groups, configure security group rules for them, separately.
    • RDS DB instance: Configure an inbound rule for the security group with which the RDS DB instance is associated.
    • ECS: The default security group rule allows all outgoing data packets. In this case, you do not need to configure a security group rule for the ECS. If not all outbound traffic is allowed in the security group, you need to configure an outbound rule for the ECS.

This section describes how to configure an inbound rule for an RDS DB instance.

The default security group rule allows all outgoing data packets. ECSs and RDS instances can access each other if they are in the same security group. After a security group is created, you can configure security group rules to control access from and to the RDS instances in the security group.

• By default, you can create a maximum of 100 security groups in your cloud account.
• By default, you can add up to 50 security group rules to a security group.
• One RDS instance can be associated with multiple security groups, and one security group can be associated with multiple RDS instances.
• To access an RDS instance from resources outside the security group, you need to configure an inbound rule for the security group associated with the DB instance.
• To ensure data and instance security, use permissions properly. You are advised to use the minimum access permission, change the default database port 5432, and set the accessible IP address to the remote server's address or the remote server's minimum subnet address to control the access scope of the remote server.
• The default value of Source is 0.0.0.0/0, indicating that RDS DB instances in the security group can be accessed from any IP address.

1. Log in to the management console.
2. Click in the upper left corner and select a region and a project.
3. Click in the upper left corner of the page and choose Database > Relational Database Service.
4. On the Instances page, click the target DB instance to go to the Basic Information page.
5. In the Connection Information area, click the security group name next to the Security Group field.
6. On the Inbound Rules tab page, click Add Rule. In the displayed dialog box, set required parameters to add an inbound rule.

   To add more inbound rules, click +.

   Table 1 Inbound rule parameters

   Parameter	Description	Example Value
   Priority	Security group rule priority. Value range: 1 to 100. The default value is 1 and indicates the highest priority. A rule with a smaller value has a higher priority.	1
   Action	Action of the security group rule. A rule with a deny action overrides another with an allow action if the two rules have the same priority.	Allow
   Protocol & Port	Protocol: network protocol. Available options include ANY, TCP, UDP, and ICMP.	TCP
   	Port: the port over which the traffic can reach your DB instance. RDS for PostgreSQL instances can use database ports 2100 to 9500.	5432
   Type	IP address type.	IPv4
   Source	Source address. It can be a single IP address, an IP address group, or a security group to allow access from them to your DB instance. Example: Individual IP address: 192.168.10.10/32 (IPv4); IP address range: 192.168.1.0/24 (IPv4); Default IP addresses: 0.0.0.0/0 (any IPv4 address); Security group: sg-abc	0.0.0.0/0
   Description	Supplementary information about the security group rule. This parameter is optional. The description can contain a maximum of 255 characters and cannot contain angle brackets (<) or (>).	N/A

7. Click OK.