제어 영역 보안 그룹은 제어 영역 노드와 관리 서비스 간, 제어 영역 노드와 노드 풀 간의 연결을 허용합니다.
제어 영역은 AWS 네트워크 부하 분산기(NLB) 뒤에 있는 세 개의 EC2 인스턴스로 구성됩니다.
이러한 인스턴스는 다른 노드, 노드 풀 노드, NLB의 etcd 인스턴스에서 연결하도록 허용합니다. GKE on AWS 구성요소를 업데이트하기 위해 모든 아웃바운드 HTTP/HTTPS 트래픽이 허용됩니다.
[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-04(UTC)"],[],[],null,["# Security groups for GKE on AWS\n\nThis topic explains the\n[AWS security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)\n(SG) you need for GKE on AWS.\n\nIf you\n[Install a management service](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management) or\n[Use an existing AWS VPC](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/integrating-existing-infrastructure),\n`anthos-gke` creates security groups for you. You can configure your\n[AWSCluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awscluster) and\n[AWSNodePool](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/node-pools) CRDs with a list of additional\nsecurity group IDs.\n\nThe following diagram outlines how GKE on AWS uses security groups\nto connect to Google Cloud and AWS services.\n\nManagement service security group\n---------------------------------\n\nThe management service security group allows access to the management service\nAPI with HTTPS. If you have a\n[bastion host](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management#connect) configured,\nInbound from the bastion security group is allowed.\n\nIf you create a GKE on AWS environment into an existing AWS VPC,\nyou must have a security group that allows the following connections.\n\n### Outbound domain access\n\nThe management service requires outbound access to the following domains.\n\n- `gkeconnect.googleapis.com`\n- `gkehub.googleapis.com`\n- `oauth2.googleapis.com`\n- `storage.googleapis.com`\n- `www.googleapis.com`\n- `gcr.io`\n- `k8s.gcr.io`\n- \u003cvar translate=\"no\"\u003eEC2-REGION\u003c/var\u003e`.ec2.archive.ubuntu.com`\n\nReplace \u003cvar translate=\"no\"\u003eEC2-REGION\u003c/var\u003e with the AWS EC2 region where your\nGKE on AWS installation runs. For example,\n`us-west-1.ec2.archive.ubuntu.com/`.\n\nIf you are using\n[Cloud Service Mesh with Prometheus and Kiali](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/ingress),\nallow outbound access from the following domains:\n\n- `docker.io`\n- `quay.io`\n\nBastion host security group (optional)\n--------------------------------------\n\nYou use the bastion host security group connections allowed by his group to\nconnect into your GKE on AWS management service and user\nclusters. This group is optional and only included if you use `anthos-gke` to\ncreate a GKE on AWS installation in a\n[dedicated VPC](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management).\n\nControl plane security group\n----------------------------\n\nThe control plane security group allows connections between control plane nodes\nand the management service, and between control plane nodes and node pools.\n\nThe control plane consists of three\n[EC2](https://aws.amazon.com/ec2/)\ninstances behind an AWS Network Load Balancer\n([NLB](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)).\nThese instances accept connections from etcd instances on other nodes, node pool\nnodes, and the NLB. In order to update GKE on AWS components, all\noutbound HTTP/HTTPS traffic is allowed.\n\nYou specify the security group IDs\nin your [AWSCluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awscluster) definition.\n\nNode pool security group\n------------------------\n\nThe node pool security group allows connections from the control plane\nand other node. You specify the security group IDs\nin your [AWSNodePool](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/node-pools) definitions."]]
