Security group overview
A security group acts as a virtual firewall created within a VPC network to provide security for BCC instances, DCC instances, load balancer instances, and cloud database instances. It defines incoming and outgoing access rules based on IP and port, thereby enhancing the protection of cloud resources.
What is a security group
A security group is a virtual firewall that manages the inbound and outbound traffic for BCC instances. By configuring security group rules, you can control which traffic is allowed or denied for instances within the group.
Security groups are divided into regular security groups and enterprise security groups with the following functions:
| Function | Regular security group | Enterprise security group |
|---|---|---|
| No rules specified for security group | Ingress: Deny all access requests Egress: Deny all access requests |
Ingress: Deny all access requests Egress: Deny all access requests |
| Default rules for new security groups | Ingress: Deny all access requests Egress: Allow all access requests |
Ingress: Deny all access requests Egress: Allow all access requests |
| Security group rule strategy | Only support the Allow policies | Support the Allow and Deny policies |
| Set rule priority | Complete Allow List mechanism without priority | Value range: 1-1000. The smaller the value, the higher the priority. If Allow and Deny rules share the same priority, Deny takes precedence. Rules are evaluated in order, from the highest to the lowest priority. |
| Select security group for Source or Target | Support | Not supported |
| Count of associated instances | Unlimited | Unlimited |
| Instance associating with multiple security groups | All rules are matched one by one. If any rule allows, the request is allowed. | All rules in the associated enterprise security groups are reordered by priority, and rules are matched by priority. If Allow and Deny policies have the same priority, Deny takes precedence. |
| Application scenarios | For scenarios with low operation and maintenance costs | For scenarios requiring more refined network control |
Usage restrictions
- Every VPC automatically generates a default regular security group. This group cannot be deleted but allows rule addition, deletion, and modification. A One-click Restoration to Initial Setting button is available only for the default security group.
- Each BCC instance can associate with up to 10 security groups. When associated with multiple groups, the effective rules for the instance will be the combined rules from all associated groups.
- A security group can hold a maximum of 50 ingress rules and 50 egress rules.
- If a BCC instance has only one associated security group, that group cannot be disassociated.
- An instance cannot be simultaneously associated with both regular security groups and enterprise security groups.
Security group rule
Components
Security group rules include the following components:
- Direction: Egress or Ingress.
- Type: IPv4 or IPv6.
- Protocol and Port: Supported protocols include TCP, UDP, ICMP, etc.
- Source/Purpose: Regular security groups allow selection of IP or security groups, while enterprise security groups support only IP selection.
- Policy: Enterprise security groups offer a choice between Allow and Deny policies, whereas regular security groups support only the Allow policy.
- Priority: Enterprise security groups allow rule priorities to be set between 1-1000, with smaller numbers indicating higher priority.
Common operations
To create a new security group, refer to [Create Security Group](Create a security group.md).
To associate a security group with a BCC instance after creating it, refer to [Associate Security Group](Associate with security group.md).
To remove a BCC instance from a security group, refer to [Disassociate Security Group](Disassociate security group.md).