Learn about and manage managed security groups and related permissions on API operations -

Managed security groups are created by cloud service systems to ensure service availability. In scenarios where cloud resources are shared among multiple users and teams, managed security groups can prevent failures or security risks caused by user misoperation. This enhances the overall stability and security of cloud services. This topic describes managed security groups and the permissions on related API operations.

Background information

A security group created in managed mode is a managed security group. This mode is designed to resolve premission control issues for operations on security groups in cloud services, such as Network Load Balancer (NLB) and Secure Access Service Edge (SASE). Managed security groups are managed by cloud service systems. You can view managed security groups but cannot perform operations on them. The following section describes managed security groups.

Note

Alibaba Cloud services use Security Token Service (STS) to grant permissions to Resource Access Management (RAM) roles of your account to create managed security groups. For information about STS, see What is STS?

In a cloud service console, you cannot perform operations on managed security groups but can view information about these security groups.
You can call only query API operations to access managed security groups. If you call an API operation to perform operations on a managed security group, an error message appears with the InvalidOperation.ResourceManagedByCloudProduct error code. The error message indicates that the security group is managed by a cloud service system and you cannot perform operations on the security group. For information about the permissions, see the Permissions on API operations related to managed security groups section of this topic.

You can call the DescribeSecurityGroups operation to check whether the ServiceManaged parameter value of a security group is True. You can also check whether an error message similar to You cannot modify security groups managed by cloud services is displayed in the service console. If yes, the security group is a managed security group.

Permissions on API operations related to managed security groups

In the following table, × indicates that an operation is not supported and √ indicates that an operation is supported.

API operation	Description	Can be called by an Alibaba Cloud account	Can be called by the cloud service system that creates a managed security group
AuthorizeSecurityGroup	Adds an inbound rule to a security group. Adds an inbound rule that references a managed security group as the authorization object.	×	√
AuthorizeSecurityGroupEgress	Adds an outbound rule to a security group. Adds an outbound rule that references a managed security group as the autorization object.	×	√
RevokeSecurityGroup	Deletes an inbound rule from a security group.	×	√
RevokeSecurityGroupEgress	Deletes an outbound rule from a security group.	×	√
JoinSecurityGroup	Adds a resource to a security group.	×	√
LeaveSecurityGroup	Removes a resource from a security group.	×	√
DeleteSecurityGroup	Deletes a security group.	×	√
ModifySecurityGroupAttribute	Modifies a security group.	×	√
ModifySecurityGroupRule	Modifies an inbound rule of a security group.	×	√
ModifySecurityGroupEgressRule	Modifies an outbound rule of a security group.	×	√
ModifySecurityGroupPolicy	Modifies the internal access control policy of a basic security group.	×	√
DescribeSecurityGroupAttribute	Queries security group rules.	√	√
DescribeSecurityGroups	Queries security groups.	√	√
DescribeSecurityGroupReferences	Queries the security groups whose rules reference security groups as authorization objects.	√	√
CreateNetworkInterface	Creates an elastic network interface (ENI).	×	√
ModifyNetworkInterfaceAttribute	Modifies an ENI.	×	√
RunInstances	Creates multiple instances at a time.	×	√
CreateInstance	Creates an instance.	×	√
ModifyInstanceAttribute	Modifies the security groups to which an instance belongs.	×	√