How to accurately use the new restrictions on security groups

The content of this article is about how to accurately apply new restrictions on the use of security groups. It has certain reference value. Friends in need can refer to it. I hope it will be helpful to you.

New usage restrictions of security groups

Can I adjust the upper limit of the number of security group rules?

No, each security group can contain up to 100 security group rules. If the current upper limit cannot meet your usage needs, it is recommended that you follow the steps below:

Check whether there are redundant rules. You can also submit a work order, and Alibaba Cloud technical support will provide inspection services.

If there are redundant rules, please clear the redundant rules; if there are no redundant rules, please split the security group.

Note: Currently, each elastic network card in an instance can join up to 5 security groups by default, so each elastic network card in an instance can contain up to 500 security group rules, which can meet most scenarios. needs.

Are the inbound rules and outbound rules of a security group counted differently?

Does not distinguish between. The total number of inbound and outbound rules per security group cannot exceed 100.

Does the adjustment to the upper limit of the number of VPC type instances only take effect for newly added security groups?

no. Currently, the upper limit for the number of VPC type instances is 2,000, which takes effect for the security groups of all VPC type instances. It should be noted that the upper limit of 2000 refers to the number of private IPs included in all instances (the primary network card and the secondary network card share this quota), not the number of instances. However, if you do not enable the secondary network card, 2000 private IPs are equivalent to 2000 instances.

Why does an over limit prompt appear when an instance is added to a security group?

The upper limit of the number of security group rules that apply to an instance (primary network card) = the number of security groups that the instance is allowed to join x the maximum number of rules for each security group.

If the prompt "Failed to join the security group, the number of security group rules acting on this instance has reached the upper limit" appears, it means that the total number of rules actually acting on the current instance has exceeded the upper limit. You can check the total number of rules by following the following steps:

Log in to the ECS management console.

Go to the Examples page.

In the Action column of the specified instance, click More > Network and Security Groups > Security Group Configuration.

On the Security Group page of this instance, switch the tab to view all the rules for the intranet inbound direction and all the rules for the intranet inbound direction.

Lowering the upper limit of the number of rules causes the limit to be exceeded. Can the security group be used normally?

Existing security groups will not be affected. An example is as follows:

You set each instance to join 5 security groups, and each security group can contain 100 security group rules. Security group A already contains 51 security group rules. Then, submit a work order to adjust it so that each instance can join 10 security groups, and each security group can contain 50 security group rules.

In this case, you can still use security group A normally. However, if you add security group rules to security group A again, the system will prompt that the number of security group rules exceeds the upper limit.

The above is the detailed content of How to accurately use the new restrictions on security groups. For more information, please follow other related articles on the PHP Chinese website!