Managing Security Group Rules
Security group rules define what traffic is allowed to and from your instances. This guide explains how to manage these rules effectively.
Understanding Rule Components
Each security group rule consists of:
- Direction: Inbound (ingress) or Outbound (egress)
- Protocol: TCP, UDP, ICMP, or All
- Port Range: Single port or range of ports
- Source/Destination: IP range (CIDR) or another security group
- Description: Optional text explaining the rule's purpose
Adding Rules
- Navigate to the security group details page
- Click Add Rule
- Select the rule direction (Inbound or Outbound)
- Choose the protocol type
- Specify the port range
- Set the source/destination
- Add a description (recommended)
- Click Add Rule to save
Rule Configuration Examples
Inbound Rules
Web Access
- Direction: Inbound
- Protocol: TCP
- Port Range: 80,443
- Source: 0.0.0.0/0
- Description: Allow HTTP/HTTPS from anywhere
SSH Access
- Direction: Inbound
- Protocol: TCP
- Port Range: 22
- Source: Your office IP range
- Description: Allow SSH from office
Database Access
- Direction: Inbound
- Protocol: TCP
- Port Range: 3306
- Source: Web server security group
- Description: Allow MySQL from web servers
Outbound Rules
General Internet Access
- Direction: Outbound
- Protocol: All
- Port Range: All
- Destination: 0.0.0.0/0
- Description: Allow all outbound traffic
External Database Access
- Direction: Outbound
- Protocol: TCP
- Port Range: 5432
- Destination: Database security group
- Description: Allow PostgreSQL connections to DB servers
Email (SMTP) Access
- Direction: Outbound
- Protocol: TCP
- Port Range: 587
- Destination: 0.0.0.0/0
- Description: Allow email sending via SMTP
Modifying Rules
- Find the rule you want to modify
- Click the Edit button (pencil icon)
- Make your changes
- Click Save to apply the modifications
Deleting Rules
- Locate the rule you want to remove
- Click the Delete button (trash icon)
- Confirm the deletion
Troubleshooting Common Issues
Connection Problems
If instances can't communicate:
- Verify required ports are open in both directions
- Check if the correct protocols are allowed
- Confirm IP ranges or security group references are correct
- Ensure rules haven't been modified recently