[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-09-04 (世界標準時間)。"],[],[],null,["# Security groups rules\n\nThis topic explains how GKE on AWS manages\n[AWS security groups](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)\nrules for the cluster, and how to modify the firewall rules for node pools and\ncontrol plane replicas.\n\nSecurity groups and hosted DNS\n------------------------------\n\nIf you use a hosted DNS server instead of the AWS-provided DNS, your\n[control plane](#control_plane_security_groups)\nand [node pool](#node_pool_security_groups)\nsecurity groups must allow outbound traffic on TCP and UDP port 53.\n\nControl plane security groups\n-----------------------------\n\nThe control plane security groups define the firewall rules for inbound and\noutbound TCP traffic for each control plane replica.\n\nThe control plane consists of three\n[EC2](https://aws.amazon.com/ec2/)\ninstances behind an AWS Network Load Balancer\n([NLB](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/introduction.html)).\nThese instances accept connections from etcd instances on other nodes, node pool\nnodes, and the NLB. Control plane instances also make outbound HTTPS connections\nto Google and AWS services.\n\nGKE on AWS creates and attaches a managed control plane security\ngroup to all control plane instances. You should not modify the rules in this\ngroup. If you need to add more security group rules, you can instead specify\nadditional security group IDs to attach to the control plane when you\n[Create a cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-cluster).\n\n### Default control plane security group rules\n\nThese are the default rules GKE on AWS attaches to the control\nplane. These rules will not match your security groups exactly; each row in the\ntable might expand to multiple AWS security group rules.\n\nNode pool security groups\n-------------------------\n\nThe node pool security groups define the firewall rules for inbound and\noutbound TCP traffic for the VMs in node pools.\n\nGKE on AWS creates and attaches a managed node pool security\ngroup to all node pool instances. You should not modify the rules in this\ngroup. If you need to add more security group rules, you can instead specify\nadditional security group IDs to attach to instances when you\n[Create a node pool](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-node-pool).\n\nBy default, node pool VMs do not have any open ports. To allow incoming traffic,\nyou add a node pool security group when creating the node pool, and\nmanage any desired inbound/outbound rules for the node pool through that\nsecurity group.\n\n### Default node pool security group rules\n\nThese are the default rules GKE on AWS attaches to node pools. These rules will not match your security groups exactly; each row in the table might expand to multiple AWS security group rules.\n\n### Node pools in VPC Secondary CIDR blocks\n\nGKE on AWS version 1.26 and later automatically creates and\nmanages the necessary security group rules to support node pools using subnets\nin secondary VPC CIDR blocks. If you're using one of these versions, you don't\nneed to create custom security groups or update them manually.\n\nHowever, when creating managed control plane security groups, earlier versions\nof GKE on AWS don't create rules that support node pools with\nsubnets in a\n[secondary VPC CIDR block](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Subnets.html).\n\nTo work around this limitation, create a custom security group for your control\nplane. You pass the security group ID when creating a cluster using the\n[`--security-group-ids`](/sdk/gcloud/reference/container/aws/clusters/create#--security-group-ids)\nflag. Alternatively, you can\n[Update your cluster's security groups](/kubernetes-engine/multi-cloud/docs/aws/how-to/update-cluster#update_your_clusters_security_groups).\n\nCreate the security group with the following rules:\n\nWhat's next\n-----------\n\n- [Create a cluster](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-cluster).\n- [Create a node pool](/kubernetes-engine/multi-cloud/docs/aws/how-to/create-node-pool)."]]
