Menu

Lumen help

Adding, editing, and deleting rules of an AWS security group

Use the Edge Services portal to add, edit, and delete rules of an Amazon Web Services (AWS) security group for provisioned AWS instances. Rules determine the incoming and outgoing traffic allowed by the security group. You can add or remove security groups on AWS instances. You can also view details about, edit, create, or delete a security group.

Adding a rule to an AWS security group
Editing a rule on an AWS security group
Deleting a rule on an AWS security group

Adding a rule to an AWS security group

To add a rule to an AWS security group:

  1. Click Infrastructure, then click Network.

    The Edge Services portal shows the networks created for your organization.
Showing network list
  1. Select the Security Groups tab.
Networks page showing security groups.
  1. Click the security group.

    The Edge Services portal shows the security group details page. 
Security group details page.
  1. In the RULES section, click +ADD RULE.

    The Rule window appears.
Security group Rule window for adding a rule.
  1. In the Rule window, complete the following fields:
Field Description
NAME Type a name for the rule.
DIRECTION
  • ingress—Select this option to make a rule for incoming traffic. This selection enables the SOURCE field for the rule. If you select this option, select Instance for DESTINATION TYPE.
  • egress—Select this option to make a rule for outgoing traffic. This selection enables the DESTINATION field for the rule. If you select this option, you enable the DESTINATION or DESTINATION GROUP fields.
RULE TYPE Select the third-party service to which this rule applies. For example, select a service that provides virtual machines. If you select Custom Rule, you enable the PROTOCOL and PORT RANGE fields.
PROTOCOL
This field is only available if you selected Custom Rule for RULE TYPE.
  • TCP—Select this option to have the rule use the Transmission Control Protocol (TCP) for transmission.
  • UDP—Select this option to have the rule use the User Datagram Protocol (UDP) for transmission.
  • ICMP—Select this option to have the rule use the Internet Control Message Protocol (ICMP) for connection checking.
PORT RANGE This field is only available if you selected Custom Rule for RULE TYPE. Type a port or range for ports (from 1 to 65000) used by the rule. For example, 22 or 6500-7500.
SOURCE TYPE
  • Network—Select this option to allow traffic to or from the network to which this security group is assigned.
  • Security Group—This option is only available if you selected ingress for DIRECTION. Select this option to allow traffic from all instances using a specified security group.
  • All—Select this option to allow traffic from all sources.
SOURCE

This field is only available if you selected Network or All for SOURCE TYPE. Type one of the following sources for the rule:

  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for virtual private clouds (VPC).
  • The ID of a security group.
SOURCE GROUP This field is only available if you selected Security Group for SOURCE TYPE. Select the security group to use to allow traffic from all instances using that security group.
DESTINATION TYPE
  • Instance — Select this option to make an instance the destination. If you selected ingress for DIRECTION, this is the only option available.
  • Security Group — This option is only available if you selected egress for DIRECTION. Select this option to allow traffic to all instances using a specified security group.
DESTINATION

This field is only available if you selected Network or All for SOURCE TYPE. Type one of the following destinations for the rule:

  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for VPCs.
  • The ID of a security group.
DESTINATION GROUP This field is only available if you selected Security Group for DESTINATION TYPE. Select the security group to use to allow traffic to all instances using that security group.
  1. Click Save Changes.

    The Edge Services portal adds the rule to the security group.

Editing a rule on an AWS security group

To edit a rule on an AWS security group:

  1. Click Infrastructure, then click Network.

    The Edge Services portal shows the networks created for your organization.
Showing network list
  1. Select the Security Groups tab.
Networks page showing security groups.
  1. Click the security group.

    The Edge Services portal shows the security group details page. 
Security group details page.
  1. In the RULES section, click the Edit icon on the rule.

    The Rule window appears.
Security group Rule window for editing a rule.
  1. In the Rule window, edit the following fields as needed:
Field Description
NAME Type a name for the rule.
DIRECTION
  • ingress—Select this option to make a rule for incoming traffic. This selection enables the SOURCE field for the rule. If you select this option, select Instance for DESTINATION TYPE.
  • egress—Select this option to make a rule for outgoing traffic. This selection enables the DESTINATION field for the rule. If you select this option, you enable the DESTINATION or DESTINATION GROUP fields.
RULE TYPE Select the third-party service to which this rule applies. For example, select a service that provides virtual machines. If you select Custom Rule, you enable the PROTOCOL and PORT RANGE fields.
PROTOCOL
This field is only available if you selected Custom Rule for RULE TYPE.
  • TCP—Select this option to have the rule use the Transmission Control Protocol (TCP) for transmission.
  • UDP—Select this option to have the rule use the User Datagram Protocol (UDP) for transmission.
  • ICMP—Select this option to have the rule use the Internet Control Message Protocol (ICMP) for connection checking.
PORT RANGE This field is only available if you selected Custom Rule for RULE TYPE. Type a port or range for ports (from 1 to 65000) used by the rule. For example, 22 or 6500-7500.
SOURCE TYPE
  • Network—Select this option to allow traffic to or from the network to which this security group is assigned.
  • Security Group—This option is only available if you selected ingress for DIRECTION. Select this option to allow traffic from all instances using a specified security group.
  • All—Select this option to allow traffic from all sources.
SOURCE

This field is only available if you selected Network or All for SOURCE TYPE. Type one of the following sources for the rule:

  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for virtual machines (VPC).
  • The ID of a security group.
SOURCE GROUP This field is only available if you selected Security Group for SOURCE TYPE. Select the security group to use to allow traffic from all instances using that security group.
DESTINATION TYPE
  • Instance—Select this option to make an instance the destination. If you selected ingress for DIRECTION, this is the only option available.
  • Security Group—This option is only available if you selected egress for DIRECTION. Select this option to allow traffic to all instances using a specified security group.
DESTINATION

This field is only available if you selected Network or All for SOURCE TYPE. Type one of the following destinations for the rule:

  • A single IPv4 address using the /32 prefix length. For example, 101.0.121.1/32.
  • A single IPv6 address using the /128 prefix length. For example, 2002:db7:1212:1c00::231/128.
  • A range of IPv4 addresses in CIDR block notation. For example, 101.0.121.1/24.
  • A range of IPv6 addresses in CIDR block notation. For example, 2002:db7:1212:1c00::231/64.
  • The ID of a prefix list for VPCs.
  • The ID of a security group.
DESTINATION GROUP This field is only available if you selected Security Group for DESTINATION TYPE. Select the security group to use to allow traffic to all instances using that security group.
  1. Click Save Changes.

    The Edge Services portal saves the edits to the rule on the security group.

Deleting a rule on an AWS security group

To delete a rule on an AWS security group:

  1. Click Infrastructure, then click Network.

    The Edge Services portal shows the networks created for your organization.
Showing network list
  1. Select the Security Groups tab.
Networks page showing security groups.
  1. Click the security group.

    The Edge Services portal shows the security group details page. 
Security group details page.
  1. In the RULES section, click the Delete icon on the rule.
  1. In the confirmation window that appears, click OK.

    The Edge Services portal deletes the rule on the security group.