Security group

Initialization

Confirm Endpoint

When confirming SDK usage and configuring endpoint, understand the related concepts of endpoint. Baidu AI Cloud currently supports multiple regions. Please refer toRegion Selection Guide. North China - Beijing, South China-Guangzhou, East China - Suzhou, Hong Kong, Central China-Wuhan (Financial) and North China - Baoding are supported currently. Corresponding endpoint details are as follows:

Retrieve access key

To use the security group of Baidu AI Cloud, you need a valid AK (Access Key ID) and SK (Secret Access Key) for signature certification. AK/SK are system-assigned strings used to identify users and perform signature certification for BOS. Your AK/SK information can be obtained and understood through the following steps: Register a Baidu AI Cloud account Create AK/SK

Create BccClient

The BccClient enables developers to interact with the security group service by providing a variety of methods.

When creating a new BccClient, first configure BccConfigs using endpoint, AK, and SK, then use the BccConfigs instance to configure the BccClient. Configuration example is as follows:

1 $BccConfigs = array(
2    'credentials' => array(
3          'ak' => '',
4          'sk' => '',
5    ),
6    'endpoint' => 'bcc.bj.baidubce.com',  //bj
7);
8$BccClient = new BccClient($BccConfigs)

Security group management

• When creating a BCC instance, you have the option to use either the default security group or a custom security group.
• Every BCC instance must be associated with a security group.
• Each BCC instance can associate with up to 10 security groups. When associated with multiple groups, the effective rules for the instance will be the combined rules from all associated groups.
• Users can allow communication between all BCC instances associated with the same security group or between instances belonging to different security groups. By default, all BCC instances in the same security group can communicate with each other.
• Security group association for BCC instances at the group level is not supported; instances can only be added to security groups.
• Default security groups cannot be deleted, but their rules can be added, removed, or modified. Only the default security group includes a "One-click Restoration to Initial Setting" option.

Default security group rules:

• Ingress: Allows unrestricted access to all ports, permitting traffic from all external IPs to enter all ports associated with the BCC.
• Egress: Grants access to all ports, allowing all ports associated with BCC to connect to any external IP ports.

Create security group

The createSecurityGroup function can be used to create a security group. The function is defined as follows:

1public function createSecurityGroup($name, $rules, $vpcId=null, $desc=null, $clientToken=null, $options = array()) {
2	......
3 }

The parameters for createSecurityGroup are as follows:

The parameter "rules" is of the list type and can include multiple security group rules. The parameters for defining these rules are as follows:

Usage examples are as follows:

1$securityGroupName = 'test'
2$rule = new SecurityGroupRuleModel('test_rule', 'ingress', null, '1-65535', 'tcp', '', '');
3$rules = array($rule);
4$resp = $this->client->createSecurityGroup($securityGroupName, $rules, null);
5print_r($resp);

List security groups

The listSecurityGroups function can be used to list security groups. The function is defined as follows:

1public function listSecurityGroups($instanceId=null, $vpcId=null, $marker=null, $maxKeys=null, $options = array()){
2	......
3 }

listSecurityGroups parameters are as follows:

Usage examples are as follows:

1$resp = $this->client->listSecurityGroups($this->instanceId);
2print_r($resp);

Delete a security group

The deleteSecurityGroup function can be used to delete a security group. The function is defined as follows:

1public function deleteSecurityGroup($securityGroupId, $options = array()) {
2	......
3 }

The deleteSecurityGroup parameter mainly includes securityGroupId, which represents the security group to be deleted.

Note: securityGroupId can be obtained by listing security groups.

Usage examples are as follows:

1$resp = $this->client->deleteSecurityGroup($this->securityGroupId);
2print_r($resp);

Authorize security group rules

The authorizeSecurityGroupRule function can be used to authorize new security group rules within a security group. The function is defined as follows:

1public function authorizeSecurityGroupRule($securityGroupId, $rule, $clientToken=null, $options = array()) {
2	......
3 }

The parameters for authorizeSecurityGroupRule are as follows:

Note: Within the same security group, rules are uniquely indexed based on the six-tuple combination of remark, protocol, direction, portRange, sourceIp | destIp, and sourceGroupId | destGroupId. If an identical rule already exists in the security group, an error will be reported.

Usage examples are as follows:

1$direction = 'ingress';
2$portRange = '80-90';
3$protocol = 'tcp';
4$rule = new SecurityGroupRuleModel(null, $direction, null, $portRange, $protocol);
5$resp = $this->client->authorizeSecurityGroupRule($this->securityGroupId, $rule);
6print_r($resp);

Revoke security group rules

The revokeSecurityGroupRule function can be used to revoke security group rules within a security group. The function is defined as follows:

1public function revokeSecurityGroupRule($securityGroupId, $rule, $clientToken=null, $options = array()){
2    ......
3 }

revokeSecurityGroupRule parameters are as follows:

Note: Within the same security group, rules are uniquely indexed based on the six-tuple combination of remark, protocol, direction, portRange, sourceIp | destIp, and sourceGroupId | destGroupId. If an identical rule already exists in the security group, an error will be reported.

Usage examples are as follows:

1$direction = 'ingress';
2$portRange = '80-90';
3$protocol = 'tcp';
4$rule = new SecurityGroupRuleModel(null, $direction, null, $portRange, $protocol);
5$resp = $this->client->revokeSecurityGroupRule($this->securityGroupId, $rule);
6print_r($resp);