Security group
Updated at：2025-10-20
Query the security group list
You can query the security group list with the following code:
Java
1public static void listSecurityGroup(BccClient bccClient) {
2 ListSecurityGroupsRequest listSecurityGroupsRequest = new ListSecurityGroupsRequest();
3 // Set pagination flag
4 listSecurityGroupsRequest.setMarker(securityGroupId);
5 // Set size of paginated returned data
6 listSecurityGroupsRequest.setMaxKeys(maxKey);
7 // Set BCC instance ID for filtering
8 listSecurityGroupsRequest.setInstanceId(instanceId);
9 // Designate VPC ID for filtering
10 listSecurityGroupsRequest.setVpcId(vpcId);
11 // Execute operation to retrieve security group list
12 ListSecurityGroupsResponse listSecurityGroupsResponse = bccClient.listSecurityGroups(listSecurityGroupsRequest);
13 for (SecurityGroupModel securityGroupModel : listSecurityGroupsResponse.getSecurityGroups()) {
14 System.out.println(securityGroupModel.getName());
15 }
16}Create a security group
You can create a security group with the following code:
Java
1public static void createSecurityGroup(BccClient bccClient) {
2 CreateSecurityGroupRequest createSecurityGroupRequest = new CreateSecurityGroupRequest();
3 // Set security group name
4 createSecurityGroupRequest.setName(newName);
5 // Set security group description
6 createSecurityGroupRequest.setDesc(newDescription);
7 List<SecurityGroupRuleModel> rules = new ArrayList<SecurityGroupRuleModel>();
8 rules.add(new SecurityGroupRuleModel()
9 // Set remarks
10 .withRemark(securityGroupRemark)
11 // Set protocol type
12 .withProtocol(securityGroupProtocol)
13 // Set port range, defaulting to 1-65535 when empty. A single port such as 80 can be specified
14 .withPortRange(securityGroupPortRange)
15 // Set ingress/egress, value: ingress or egress, required
16 .withDirection(securityGroupDirection)
17 // Set source IP address, which cannot be set simultaneously with sourceGroupId
18 .withSourceIp(securityGroupSourceIp)
19 // Set source security group ID
20 .withSourceGroupId(securityGroupSourceGroupId));
21 rules.add(new SecurityGroupRuleModel()
22 // Set remarks
23 .withRemark(securityGroupRemark)
24 // Set protocol type
25 .withProtocol(securityGroupProtocol)
26 // Set port range, defaulting to 1-65535 when empty. A single port such as 80 can be specified
27 .withPortRange(securityGroupPortRange)
28 // Set ingress/egress, value: ingress or egress, required
29 .withDirection(securityGroupDirection)
30 // Set destination IP address, which cannot be set simultaneously with destGroupId
31 .withDestIp(securityGroupDestIp)
32 // Set destination security group ID
33 .withDestGroupId(securityGroupDestGroupId));
34 // Set security group rules
35 createSecurityGroupRequest.setRules(rules);
36 List<TagModel> listTags = new ArrayList<TagModel>();
37 // Set the tag to be bound
38 TagModel tagModel = new TagModel().withTagKey("test007").withTagValue("test007");
39 listTags.add(tagModel);
40 // Set tag list
41 createSecurityGroupRequest.setTags(listTags);
42
43 // Create security group
44 System.out.println(bccClient.createSecurityGroup(createSecurityGroupRequest).getSecurityGroupId());
45 }Rules within the same security group are uniquely indexed by a 6-tuple of remark, protocol, direction, portRange, sourceIp|destIp, and sourceGroupId|destGroupId. Duplicate entries will trigger a 409 error. Value of protocol (tcp|udp|icmp), defaulting to empty, representing all. For detailed descriptions of the API for creating security group rules, refer to the BCC API documentation [Create a Security Group](BCC/API Reference/Security Group Related Interfaces/Create a security group.md).
Delete a security group
You can delete the specified security group with the following code:
Java
1public static void deleteSecurityGroup(BccClient bccClient) {
2 // Delete security group with ID securityGroupId
3 bccClient.deleteSecurityGroup(securityGroupId);
4}Authorize security group rules
You can add authorized security group rules to a specified security group with the following code:
Java
1public static void authorizeSecurityGroupRule(BccClient bccClient) {
2 SecurityGroupRuleOperateRequest securityGroupRuleOperateRequest = new SecurityGroupRuleOperateRequest();
3 securityGroupRuleOperateRequest.setSecurityGroupId(securityGroupId);
4 SecurityGroupRuleModel securityGroupRuleModel = new SecurityGroupRuleModel()
5 // Set remarks
6 .withRemark(securityGroupRemark)
7 // Set protocol type
8 .withProtocol(securityGroupProtocol)
9 // Set port range, defaulting to 1-65535 when empty. A single port such as 80 can be specified
10 .withPortRange(securityGroupPortRange)
11 // Set ingress/egress, value: ingress or egress, required
12 .withDirection(securityGroupDirection)
13 // Set source IP address, which cannot be set simultaneously with sourceGroupId
14 .withSourceIp(securityGroupSourceIp)
15 // Set source security group ID
16 .withSourceGroupId(securityGroupSourceGroupId);
17 // Set security group rules
18 securityGroupRuleOperateRequest.setRule(securityGroupRuleModel);
19 // Execute operation to authorize security group rules
20 bccClient.authorizeSecurityGroupRule(securityGroupRuleOperateRequest);
21}
- Rules within the same security group are uniquely identified by a 6-tuple comprising remark, protocol, direction, portRange, sourceIp|destIp, and sourceGroupId|destGroupId. Duplicating entries will result in a 409 error.
- For detailed descriptions of the API, refer to the BCC API documentation [Authorize Security Group Rules](BCC/API Reference/Security Group Related Interfaces/Authorize security group rules.md).
Revoke security group rules
You can revoke authorized security group rules to a specified security group with the following code:
Java
1public static void revokeSecurityGroupRule(BccClient bccClient) {
2 SecurityGroupRuleOperateRequest securityGroupRuleOperateRequest = new SecurityGroupRuleOperateRequest();
3 // Set security group rule ID
4 securityGroupRuleOperateRequest.setSecurityGroupId(securityGroupId);
5 SecurityGroupRuleModel securityGroupRuleModel = new SecurityGroupRuleModel()
6 // Set remarks
7 .withRemark(securityGroupRemark)
8 // Set protocol type
9 .withProtocol(securityGroupProtocol)
10 // Set port range, defaulting to 1-65535 when empty. A single port such as 80 can be specified
11 .withPortRange(securityGroupPortRange)
12 // Set ingress/egress, value: ingress or egress, required
13 .withDirection(securityGroupDirection)
14 // Set source IP address, which cannot be set simultaneously with sourceGroupId
15 .withSourceIp(securityGroupSourceIp)
16 // Set source security group ID
17 .withSourceGroupId(securityGroupSourceGroupId);
18 // Execute operation to revoke security group rules
19 bccClient.revokeSecurityGroupRule(securityGroupRuleOperateRequest);
20}
- Rules within the same security group are uniquely identified by a 6-tuple comprising remark, protocol, direction, portRange, sourceIp|destIp, and sourceGroupId|destGroupId. Duplicate entries will result in a 404 error.
- For detailed descriptions of the API, refer to the BCC API documentation [Revoke Security Group Rules](BCC/API Reference/Security Group Related Interfaces/Revoke security group rules.md).