Pre-check: Alibaba Cloud Credentials Required
aliyun configure list
If no valid profile exists, STOP and guide user to configure credentials.

Pre-check: Aliyun CLI plugin update required
aliyun configure set --auto-plugin-install true
aliyun plugin update

Observability (MUST follow for every aliyun command)

Upon loading this skill, generate a random session ID (32-char lowercase hex string) once for the entire session.

--user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

Core Workflow

IMPORTANT: Parameter Confirmation — Before executing any command or API call, ALL user-customizable parameters MUST be confirmed with the user.

1. Security Group Management

# List security groups in a VPC
aliyun ecs describe-security-groups --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Create security group
aliyun ecs create-security-group --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --security-group-name "<GroupName>" \
  --security-group-type normal \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Delete security group (must have no instances)
aliyun ecs delete-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

2. Security Group Rules

# View security group rules
aliyun ecs describe-security-group-attribute --security-group-id <SecurityGroupId> \
  --direction ingress \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Add inbound rule (e.g., allow SSH from specific CIDR)
aliyun ecs authorize-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 22/22 \
  --source-cidr-ip <SourceCIDR> \
  --policy accept \
  --priority 1 \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Add outbound rule
aliyun ecs authorize-security-group-egress --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 443/443 \
  --dest-cidr-ip <DestCIDR> \
  --policy accept \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Revoke inbound rule
aliyun ecs revoke-security-group --biz-region-id <RegionId> \
  --security-group-id <SecurityGroupId> \
  --ip-protocol tcp \
  --port-range 22/22 \
  --source-cidr-ip <SourceCIDR> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

3. Instance-Security Group Association

# Join instance to security group
aliyun ecs join-security-group --instance-id <InstanceId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Leave security group
aliyun ecs leave-security-group --instance-id <InstanceId> \
  --security-group-id <SecurityGroupId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

4. Network Interface (ENI) Management

# List network interfaces
aliyun ecs describe-network-interfaces --biz-region-id <RegionId> \
  --instance-id <InstanceId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Create and attach secondary ENI
aliyun ecs create-network-interface --biz-region-id <RegionId> \
  --v-switch-id <VSwitchId> \
  --security-group-id <SecurityGroupId> \
  --network-interface-name "<ENIName>" \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

aliyun ecs attach-network-interface --instance-id <InstanceId> \
  --network-interface-id <ENIId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

5. VPC Network Verification

# Check VPC and VSwitch status
aliyun vpc describe-vpcs --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

aliyun vpc describe-v-switches --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

# Check route table
aliyun vpc describe-route-table-list --biz-region-id <RegionId> \
  --vpc-id <VpcId> \
  --user-agent AlibabaCloud-Agent-Skills/alibabacloud-ecs-security-group/{session-id}

RAM Policy

Action	Resource
`ecs:DescribeSecurityGroups`	`*`
`ecs:CreateSecurityGroup`	`*`
`ecs:DeleteSecurityGroup`	`acs:ecs:::securitygroup/<SecurityGroupId>`
`ecs:DescribeSecurityGroupAttribute`	`acs:ecs:::securitygroup/<SecurityGroupId>`
`ecs:AuthorizeSecurityGroup`	`acs:ecs:::securitygroup/<SecurityGroupId>`
`ecs:AuthorizeSecurityGroupEgress`	`acs:ecs:::securitygroup/<SecurityGroupId>`
`ecs:RevokeSecurityGroup`	`acs:ecs:::securitygroup/<SecurityGroupId>`
`ecs:JoinSecurityGroup`	`acs:ecs:::instance/<InstanceId>`
`ecs:LeaveSecurityGroup`	`acs:ecs:::instance/<InstanceId>`
`ecs:DescribeNetworkInterfaces`	`*`
`ecs:CreateNetworkInterface`	`*`
`ecs:AttachNetworkInterface`	`acs:ecs:::instance/<InstanceId>`
`vpc:DescribeVpcs`	`*`
`vpc:DescribeVSwitches`	`*`
`vpc:DescribeRouteTableList`	`*`

[MUST] Permission Failure Handling: When any command fails due to permission errors, read references/ram-policies.md, use ram-permission-diagnose skill, and pause until permissions are granted.

Best Practices

Least Privilege — Only open required ports; avoid 0.0.0.0/0 as source CIDR
Separate Groups — Use different security groups for different application tiers
Audit Regularly — Periodically review security group rules for unnecessary access
Use CIDR Blocks — Restrict source IPs to known ranges rather than 0.0.0.0/0

alibabacloud-ecs-security-group

ECS Security Group and Network Management