Docs

Elastic Compute Service

Security group

Changing security groups

Applicable scenarios

This topic introduces how to add, change, or remove security groups for the network interface of ECS instances in the ECS console.

Prerequisites

A network interface can be associated with at least one security group and at most five security groups.

A network interface can only associate with the security group within the same VPC.

Manage security groups in a batch

If you need unified security group management for multiple ECS instances, you can add, change, or remove security groups for instances in a batch.

tip

This feature is supported by the orchestration service, which by default uses the CustomerRoleForOOS role to submit operations. If you are a first time user, please refer to Orchestration permission management to create this role.

To manage security groups in bulk, make sure that the selected instances reside in the same VPC.

Add to security group

Replace security group

Remove from security group

warning

When you add network interfaces to a security group in a batch, the security groups originally associated with selected network interfaces are not affected.

In the left-side navigation pane, select "Instances & Images > Instances".

In the top menu bar, select the region and project where the target instance resides.

On the Instances page, select one or more instances, and then select the "··· > Add to security group" at the bottom of the list.

In the "In bulk Add to security group" window that the system pops up, click "Continue".

For detailed steps, you can refer to the table below.

Configuration item	Description
Select the network interface of the instance	For selected instances, you can select the network interface that you need to associate with the security group. The options include: Select all network interfaces (default): The system defaults to this option. This means you add all network interfaces associated with the ECS instance to the selected security groups. Select all primary network interfaces: After choosing this option, you add the primary network interface associated with the ECS instance to the selected security groups. Select custom network interface: In the "Network Interface" column, you can select the network interfaces that you need to add to the security group.
Select the security group	When creating an instance, you must associate at least one security group with the instance. Therefore, you can add up to 4 security groups here. The page by default displays all security groups under the current VPC. If no security group is available, please create a security group first.

Click "Save" to complete the operation.

After completing the operation, you can click the "Go to instance maintenance attribute" to view task details on the CloudOps Orchestration page.

of changing the security group for an ECS instance

In the top menu bar, select a target region.

In the left-side navigation pane, click "Instances".

On the right side of the target instance, select "··· > Network and security group> Change Security Group".

From the drop-down menu, click the network interface to be added, and then select the target security group.

Click "Save" to complete the operation.