Security policy

A security policy targets virtual machines in a security group, specifying egress and ingress traffic rules for the target objects. Security rules can be configured for different protocols and application ports.

Policy object

The policy objects of a security policy are one or more security groups. Whether intra-group communication is enabled must be configured separately for each security group.

A security group is a collection of virtual machines. To apply the same security policy to virtual machines for a specific workload, add them to the same security group and use the security group as a policy object in the required policies.

Security group members support two configuration modes:

• Static configuration: Add specified virtual machines to the security group.
• Dynamic configuration: Add virtual machines associated with specified labels to the security group.

Information:

• Security groups act on vNICs. If a virtual machine has multiple vNICs belonging to different VPCs, only the vNICs in the same VPC as the security group are added to the security group.
• When multiple labels are selected for a security group, the filtering logic for virtual machines is logical AND: only virtual machines associated with all the selected labels are included.
• When multiple security groups are added to a security policy through both static and dynamic configuration, the relationship between the security groups is logical OR. For example, if one security group is added via static configuration and another via dynamic configuration, all virtual machines included in either security group are treated as policy objects of this security policy.

Allowlist rules

You can configure ingress allowlists and egress allowlists for CIDR blocks, security groups, and policy objects defined by labels.

Only network traffic on the allowlist is permitted to flow in or out. Traffic not on the allowlist is denied by default. Security rules support TCP, UDP, and ICMP protocols. For TCP and UDP, specific ports and port ranges can be specified.

Policy logic

The packet filtering logic for security policies is shown in the following figure:

First, check whether the packet matches an intra-group communication rule. If yes, communication is permitted. If no, the packet direction is checked.

• For ingress packets: if the packet matches an ingress allowlist rule, communication is permitted; otherwise, it is denied.
• For egress packets: if the packet matches an egress allowlist rule, communication is permitted; otherwise, it is denied.

Once a virtual machine in a security group matches a security policy that permits communication, communication is permitted. Communication is denied only when all security policies matched by the virtual machine deny communication.