• Relational Database Service

  1. Help Center
  2. Relational Database Service
  3. User Guide
  4. Getting Started with MySQL
  5. Performing the Initial Configuration
  6. Creating a Security Group

Creating a Security Group

A security group is a collection of access control rules for ECSs and RDS DB instances that have the same security protection requirements and are mutually trusted in a VPC. This section describes how to create a security group to enable specific IP addresses and ports to access RDS.

Background Information

You can access RDS DB instances from a public or private network.


The default security group rule allows all outgoing data packets. ECSs and RDS DB instances can access each other if they are deployed in the same security group. After a security group is created, you can configure security group rules to control access from and to the DB instances in the security group.

By default, you can create a maximum of 500 security group rules. To prevent high network latency for the first packet, you are advised to create a maximum of 50 rules for each security group. To access RDS DB instances in your security group from a public network, you need to add an inbound rule. For example, if you want to use a client to access a DB instance from a public network or from an ECS in a different security group, you can add an inbound rule with the TCP protocol and default port 3306.


If you use, you enable all IP addresses to access RDS DB instances in the security group.


  1. Log in to the management console.
  2. Under Network, click Virtual Private Cloud.
  3. In the navigation pane on the left, click Security Group.
  4. On the Security Group page, click the target security group name.
  5. On the displayed page, click Add Rule.
  6. In the displayed dialog box, follow the prompts to add a security group rule.

    • IP address: This rule takes effect for specific IP addresses. A value of indicates that all IP addresses in the security group can access RDS DB instances.
    • Security Group: This rule allows ECSs in specific security groups to access RDS DB instances in the same security group. This rule allows access from all IP addresses of ECSs in the specific security group.

  7. Click OK.