alibabacloud-ecs-security-group

name	alibabacloud-ecs-security-group
description	Alibaba Cloud ECS security group and network management. Use for creating and managing security groups, configuring inbound/outbound rules, managing network interfaces, and troubleshooting network connectivity. Covers security group CRUD, rule management, ENI operations, and VPC network checks. Triggers: "security group", "ecs network", "firewall rule", "security group rule", "inbound rule", "outbound rule", "network interface", "ENI", "port access", "open port", "security group management".
source	alibabacloud-ecs-ops

ECS Security Group and Network Management

Manage security groups and network configurations for Alibaba Cloud ECS instances.

Pre-check: Alibaba Cloud CLI must be installed and at least version 3.3.3.

aliyun version   # must be >= 3.3.3

Pre-check: Alibaba Cloud Credentials Required

aliyun configure list

> If no valid profile exists, STOP and guide user to configure credentials.

> **Pre-check: Aliyun CLI plugin update required**
> ```bash
> aliyun configure set --auto-plugin-install true
> aliyun plugin update
> ```

## Observability (MUST follow for every aliyun command)

Upon loading this skill, generate a random session ID (32-char lowercase hex string) once for the entire session.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

## Core Workflow

> **IMPORTANT: Parameter Confirmation** — Before executing any command or API call,
> ALL user-customizable parameters MUST be confirmed with the user.

### 1. Security Group Management

```bash
# List security groups in a VPC
aliyun ecs describe-security-groups --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Create security group
aliyun ecs create-security-group --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --security-group-name "<GroupName>" \
  --security-group-type normal \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Delete security group (must have no instances)
aliyun ecs delete-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

2. Security Group Rules

# View security group rules
aliyun ecs describe-security-group-attribute --security-group-id <SecurityGroupId> \
  --direction ingress \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Add inbound rule (e.g., allow SSH from specific CIDR)
aliyun ecs authorize-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 22/22 \
  --source-cidr-ip <SourceCIDR> \
  --policy accept \
  --priority 1 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Add outbound rule
aliyun ecs authorize-security-group-egress --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 443/443 \
  --dest-cidr-ip <DestCIDR> \
  --policy accept \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Revoke inbound rule
aliyun ecs revoke-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 22/22 \
  --source-cidr-ip <SourceCIDR> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

3. Instance-Security Group Association

# Join instance to security group
aliyun ecs join-security-group --instance-id <InstanceId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Leave security group
aliyun ecs leave-security-group --instance-id <InstanceId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

4. Network Interface (ENI) Management

# List network interfaces
aliyun ecs describe-network-interfaces --biz-region-id <RegionId> \
  --instance-id <InstanceId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Create and attach secondary ENI
aliyun ecs create-network-interface --biz-region-id <RegionId> \
  --v-switch-id <VSwitchId> \
  --security-group-id <SecurityGroupId> \
  --network-interface-name "<ENIName>" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

aliyun ecs attach-network-interface --instance-id <InstanceId> \
  --network-interface-id <ENIId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

5. VPC Network Verification

# Check VPC and VSwitch status
aliyun vpc describe-vpcs --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

aliyun vpc describe-v-switches --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Check route table
aliyun vpc describe-route-table-list --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

RAM Policy

Action	Resource
ecs:DescribeSecurityGroups	*
ecs:CreateSecurityGroup	*
ecs:DeleteSecurityGroup	acs:ecs:*:*:securitygroup/<SecurityGroupId>
ecs:DescribeSecurityGroupAttribute	acs:ecs:*:*:securitygroup/<SecurityGroupId>
ecs:AuthorizeSecurityGroup	acs:ecs:*:*:securitygroup/<SecurityGroupId>
ecs:AuthorizeSecurityGroupEgress	acs:ecs:*:*:securitygroup/<SecurityGroupId>
ecs:RevokeSecurityGroup	acs:ecs:*:*:securitygroup/<SecurityGroupId>
ecs:JoinSecurityGroup	acs:ecs:*:*:instance/<InstanceId>
ecs:LeaveSecurityGroup	acs:ecs:*:*:instance/<InstanceId>
ecs:DescribeNetworkInterfaces	*
ecs:CreateNetworkInterface	*
ecs:AttachNetworkInterface	acs:ecs:*:*:instance/<InstanceId>
vpc:DescribeVpcs	*
vpc:DescribeVSwitches	*
vpc:DescribeRouteTableList	*

[MUST] Permission Failure Handling: When any command fails due to permission errors, read references/ram-policies.md, use ram-permission-diagnose skill, and pause until permissions are granted.

Best Practices

1. Least Privilege — Only open required ports; avoid 0.0.0.0/0 as source CIDR
2. Separate Groups — Use different security groups for different application tiers
3. Audit Regularly — Periodically review security group rules for unnecessary access
4. Use CIDR Blocks — Restrict source IPs to known ranges rather than 0.0.0.0/0