[[["易于理解","easyToUnderstand","thumb-up"],["解决了我的问题","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["很难理解","hardToUnderstand","thumb-down"],["信息或示例代码不正确","incorrectInformationOrSampleCode","thumb-down"],["没有我需要的信息/示例","missingTheInformationSamplesINeed","thumb-down"],["翻译问题","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["最后更新时间 (UTC)：2025-09-04。"],[],[],null,["# Security groups for GKE on AWS\n\nThis topic explains the\n[AWS security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)\n(SG) you need for GKE on AWS.\n\nIf you\n[Install a management service](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management) or\n[Use an existing AWS VPC](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/integrating-existing-infrastructure),\n`anthos-gke` creates security groups for you. You can configure your\n[AWSCluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awscluster) and\n[AWSNodePool](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/node-pools) CRDs with a list of additional\nsecurity group IDs.\n\nThe following diagram outlines how GKE on AWS uses security groups\nto connect to Google Cloud and AWS services.\n\nManagement service security group\n---------------------------------\n\nThe management service security group allows access to the management service\nAPI with HTTPS. If you have a\n[bastion host](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management#connect) configured,\nInbound from the bastion security group is allowed.\n\nIf you create a GKE on AWS environment into an existing AWS VPC,\nyou must have a security group that allows the following connections.\n\n### Outbound domain access\n\nThe management service requires outbound access to the following domains.\n\n- `gkeconnect.googleapis.com`\n- `gkehub.googleapis.com`\n- `oauth2.googleapis.com`\n- `storage.googleapis.com`\n- `www.googleapis.com`\n- `gcr.io`\n- `k8s.gcr.io`\n- \u003cvar translate=\"no\"\u003eEC2-REGION\u003c/var\u003e`.ec2.archive.ubuntu.com`\n\nReplace \u003cvar translate=\"no\"\u003eEC2-REGION\u003c/var\u003e with the AWS EC2 region where your\nGKE on AWS installation runs. For example,\n`us-west-1.ec2.archive.ubuntu.com/`.\n\nIf you are using\n[Cloud Service Mesh with Prometheus and Kiali](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/ingress),\nallow outbound access from the following domains:\n\n- `docker.io`\n- `quay.io`\n\nBastion host security group (optional)\n--------------------------------------\n\nYou use the bastion host security group connections allowed by his group to\nconnect into your GKE on AWS management service and user\nclusters. This group is optional and only included if you use `anthos-gke` to\ncreate a GKE on AWS installation in a\n[dedicated VPC](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/how-to/installing-management).\n\nControl plane security group\n----------------------------\n\nThe control plane security group allows connections between control plane nodes\nand the management service, and between control plane nodes and node pools.\n\nThe control plane consists of three\n[EC2](https://aws.amazon.com/ec2/)\ninstances behind an AWS Network Load Balancer\n([NLB](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)).\nThese instances accept connections from etcd instances on other nodes, node pool\nnodes, and the NLB. In order to update GKE on AWS components, all\noutbound HTTP/HTTPS traffic is allowed.\n\nYou specify the security group IDs\nin your [AWSCluster](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/awscluster) definition.\n\nNode pool security group\n------------------------\n\nThe node pool security group allows connections from the control plane\nand other node. You specify the security group IDs\nin your [AWSNodePool](/kubernetes-engine/multi-cloud/docs/aws/previous-generation/reference/node-pools) definitions."]]
