Alibaba Cloud international rebate Alibaba Cloud Network ACLs and Security Groups: Purchase, KYC, Billing, Limits, and Layered Network Security Setup Guide

Most users searching for this topic are dealing with a practical decision, not a design diagram. They want to know: Can my Alibaba Cloud account buy ECS and VPC resources today? Do I need identity verification first? Why was my order blocked? Should I use pay-as-you-go or subscription? Will Security Groups alone be enough, or do I also need Network ACLs? And if I enable both, how do I avoid breaking SSH, RDP, website traffic, or database connectivity?

This guide is written for that real workflow. It starts from account purchase and compliance checks, then moves into payment and renewal decisions, and finally shows how to implement layered network security on Alibaba Cloud with practical console steps, port examples, and troubleshooting procedures.

What users usually need to resolve before touching any security rule

In real projects, the first failure does not happen in the Network ACL rule table. It usually happens earlier:

• The account cannot pass identity verification.
• The order is held for risk review.
• The selected billing model does not fit the workload.
• The account has insufficient balance for pay-as-you-go resources.
• The region or quota does not allow creation of a new ECS, EIP, or VPC resource.
• A new security rule blocks remote access after deployment.

If your goal is to deploy layered network security on Alibaba Cloud, the practical sequence is:

Preparation before purchase and deployment

Account requirements

Before purchasing Alibaba Cloud resources for layered network security testing or production deployment, prepare the following:

• Alibaba Cloud international rebate An Alibaba Cloud account registered with a valid email and phone number.
• Completed real-name verification or business verification, depending on your account type and country/region.
• A payment method accepted in your billing region.
• If using enterprise purchasing, internal approval for cloud spending, renewal responsibility, and account ownership.

Identity verification and KYC checklist

Users often underestimate KYC because the account may be able to log in but still cannot purchase certain products or regions. Before planning VPC and security resources, verify:

If your KYC is pending, do not finalize an urgent migration schedule yet. Risk review can delay provisioning, especially if you are opening multiple instances quickly, requesting public IP resources, or activating services in unfamiliar regions.

Payment methods, funding, and renewal planning

From an operations perspective, billing mode affects security availability more than most users expect. If an instance expires or is suspended, your access path for security management also disappears.

Alibaba Cloud international rebate Practical billing advice:

• Use subscription for the main production ECS that hosts your jump host, VPN endpoint, or security management node.
• Use pay-as-you-go for temporary test ECS instances when validating Security Group and Network ACL behavior.
• Enable auto-renewal for production instances, system disks, public bandwidth, and any attached database resources that are business-critical.
• Keep a documented owner for billing alerts. Many outages happen because the technical team assumes finance will renew, while finance assumes the cloud admin will do it.

Permission requirements

If you use a RAM user instead of the root account, make sure it has permissions for:

• ECS instance creation and management
• VPC, vSwitch, route table, and Network ACL operations
• Security Group creation and rule editing
• Elastic IP or public bandwidth operations if public access is needed
• Snapshot and backup actions
• Billing visibility if the operator must verify renewal status

A common operational failure is that the network engineer can edit Security Groups but cannot attach or modify a Network ACL on the subnet, so deployment stops midway.

How to purchase Alibaba Cloud resources for layered network security

Step 1: Choose region and availability zone carefully

In the Alibaba Cloud console, go to the product purchase page for ECS. When selecting region and zone, do not just choose the nearest geography. Think about latency, compliance, and service availability.

Where to click:

• Console
• Elastic Compute Service
• Create Instance

How to configure:

• Select a region close to users or application dependencies.
• Alibaba Cloud international rebate Select an availability zone with the instance family and disk types you need.
• If using private connectivity to other resources, verify that your database, load balancer, and VPC components are available in the same region.

Important considerations:

• Alibaba Cloud international rebate Network ACLs and Security Groups are attached within the VPC design, so changing region later usually means migration, not a simple toggle.
• If you plan a website plus database architecture, place web and database subnets in the same region, and ideally separate them by vSwitch/subnet for cleaner ACL design.

Step 2: Select instance type, operating system, and disk layout

When creating an ECS instance that will be governed by Security Groups and Network ACLs, choose resources based on workload rather than choosing the cheapest instance blindly.

Linux installation considerations:

• Choose a current LTS image if you need predictable package support.
• Prepare SSH key-based login instead of password-only access.
• Open port 22 in the Security Group only to your office or fixed source IP range.

Windows installation considerations:

• Confirm licensing and edition requirements.
• Plan for RDP access on port 3389.
• Restrict inbound RDP source addresses to trusted locations.

Step 3: Select networking and public access options

During ECS creation, choose or create the VPC and vSwitch. This decision matters because Network ACLs are associated with subnets, while Security Groups apply to instances.

Practical design:

Important purchasing note: if your account is new, requests for public IP, bandwidth, or rapid creation of multiple instances may trigger a risk review. If time is critical, start with a small approved footprint, validate account health, and then expand.

Step 4: Understand cost before placing the order

Users comparing Network ACLs and Security Groups often actually need a cost-aware architecture decision. Typical spend is not only the ECS instance. It includes:

• System disk and any data disks
• Public bandwidth or Elastic IP
• Snapshots and backups
• Load balancer, if front-end traffic is distributed
• Alibaba Cloud international rebate Managed database, if used
• Cross-zone or cross-region traffic, depending on design

Cost comparison logic:

Detailed tutorial: configure layered security with Security Groups and Network ACLs

Step 1: Create the Security Group for instance-level control

Where to click:

• Console
• Elastic Compute Service
• Network & Security
• Security Groups
• Create Security Group

How to configure it:

• Select the same region as the ECS instance.
• Choose the VPC type Security Group.
• Alibaba Cloud international rebate Name it based on role, such as sg-web, sg-app, or sg-bastion.

How to enter parameters:

Important considerations:

• Do not allow SSH or RDP from 0.0.0.0/0 unless this is a temporary emergency change and you have compensating controls.
• If the ECS will host MySQL, do not open 3306 publicly. Allow it only from the app subnet or specific internal addresses.

Step 2: Create the Network ACL for subnet-level filtering

Where to click:

• Console
• Virtual Private Cloud
• Network ACL
• Create Network ACL

How to configure it:

• Select the target VPC.
• Create separate ACLs if you want different behavior for web, app, and database subnets.
• Associate the ACL with the vSwitch that represents the subnet.

How to enter parameters:

Example for a database subnet ACL:

Important considerations:

• Check return traffic requirements carefully. If your ACL policy is restrictive, forgetting ephemeral port ranges can break stateful application flows.
• Apply ACLs first to a test subnet or non-critical instance if possible.
• Document rule priority. A broad deny at a higher priority can silently override intended allow rules.

Step 3: Attach the Security Group to ECS instances

Where to click:

• Console
• ECS instance details
• Security Groups
• Bind Security Group

How to configure it:

• Assign web servers to the web Security Group.
• Assign app servers to the app Security Group.
• Assign bastion or admin servers to a separate tightly restricted Security Group.

Important considerations:

• Do not place unrelated roles into one broad Security Group if you intend to maintain layered access control long-term.
• When troubleshooting, verify the instance is bound to the expected Security Group. Users frequently edit one group while the ECS is attached to another.

Step 4: Configure operating system firewall rules

Network ACLs and Security Groups are not the only enforcement points. After the cloud-side configuration, log in and verify the guest operating system firewall.

Linux examples:

• Check firewalld or iptables/nftables status.
• Allow SSH, HTTP, and HTTPS if those services should be reachable.

Windows examples:

• Check Windows Defender Firewall inbound rules for RDP, IIS, or custom services.
• Confirm the service is listening on the correct interface and port.

This is one of the most common reasons for “Security Group is open but I still cannot connect.”

Step 5: Validate SSH, RDP, web, and database access

Practical test sequence after deployment:

If validation fails, test in order: route path, public IP assignment, Security Group rules, Network ACL rules, OS firewall, and service listening port.

Common purchasing, billing, and compliance issues users hit first

Order cannot be completed

Likely causes:

• Identity verification incomplete
• Payment method rejected
• Alibaba Cloud international rebate Region-specific restriction
• Risk-control review triggered by unusual order pattern
• Quota limit reached for ECS, EIP, or other network resource

Practical response:

• Check account verification status in the account center.
• Review whether the billing profile matches the account type.
• Reduce the initial order size and retry with a smaller deployment.
• Open a support ticket if compliance review is blocking a legitimate business use case.

Instance created but public access does not work

Likely causes:

• No public IP or bandwidth assigned
• Security Group inbound rule missing
• Network ACL deny rule on subnet
• Alibaba Cloud international rebate OS firewall blocking the port
• Service not started or not listening

Alibaba Cloud international rebate Account funded but resources still suspended

Billing changes may not recover every resource instantly. Verify:

• Whether the instance expired rather than only entering arrears
• Whether manual restart is required
• Whether attached services such as bandwidth, EIP, or database need separate renewal

Renewal was enabled but outage still happened

Typical reasons include:

• Auto-renewal enabled for ECS but not for attached disk or bandwidth
• Insufficient balance at renewal time
• Renewal attempted on a changed billing item after configuration change

Alibaba Cloud international rebate Configuration recommendations by scenario

For individual developers

Use one small ECS in a VPC, a tight Security Group, and a simple Network ACL only if you want to practice subnet-level isolation. Keep setup lean:

• Subscription for one stable server if hosting a personal website
• Pay-as-you-go for temporary labs
• Open only 22, 80, and 443 as needed
• Use snapshots before changing firewall or access rules

For enterprise users

Separate duties and segment workloads:

• Dedicated bastion host Security Group
• Separate ACLs for web, app, and database subnets
• RAM-based least-privilege permissions for network and billing roles
• Auto-renewal plus budget and balance alerts

For cross-border businesses

Focus on latency, compliance, and payment continuity:

• Choose the region based on user geography and legal requirements
• Test network latency before finalizing production placement
• Document acceptable payment methods for your entity and backup payment process
• Expect additional review if using multiple regions and public-facing services early in the account lifecycle

For website applications

Recommended pattern:

• Public web tier behind controlled inbound rules
• Application tier private only
• Database subnet blocked from public internet via ACL and Security Group
• HTTPS deployment with SSL certificate and DNS configured before production go-live

For database workloads

Best practice is to minimize public exposure:

• Alibaba Cloud international rebate Use private IP connectivity only where possible
• Restrict MySQL 3306 and Redis 6379 to app subnet or bastion subnet
• Take automated backups and snapshots before rule changes
• Test connection behavior under high concurrency if the database serves multiple app nodes

FAQ

Q1: Why was my Alibaba Cloud purchase rejected even though my account is registered?

A1: Registration is not always enough. ECS, public IP, or bandwidth orders may require completed identity verification, a valid payment profile, and may still enter risk-control review. Check KYC status, account type, payment validity, and whether the requested quantity or region triggered additional review.

Q2: Which is better for new users, subscription or pay-as-you-go?

A2: For short testing of Network ACLs and Security Groups, pay-as-you-go is easier. For stable workloads such as a production web server or bastion host, subscription reduces billing surprises. The practical approach is mixed billing: one subscription production instance and temporary pay-as-you-go lab instances.

Q3: Why can I see the server in the console but cannot SSH or RDP into it?

A3: Check these in order: public IP assignment, inbound Security Group rule, subnet Network ACL, OS firewall, and whether the service is listening. Also verify you opened the correct port for the correct source IP range. Many users mistakenly allow a different admin IP than the one they are currently using.

Q4: Do I really need both Security Groups and Network ACLs?

A4: If you only run one test server, Security Groups may be enough. If you manage multiple tiers or want subnet-level isolation to reduce blast radius, using both is more controllable. Security Groups manage instance-level access; Network ACLs help enforce broader subnet boundaries. In practice, layered design matters most for app and database separation.

Alibaba Cloud international rebate Q5: Why did my service stop after renewal or billing changes?

A5: Renewal may have covered only part of the stack. Check ECS instance status, disk, public bandwidth, EIP, load balancer, and database billing separately. Also verify whether the resource entered suspension, expiration, or release state before payment was completed.

Q6: How do I avoid locking myself out when editing Security Groups or ACLs?

A6: Keep one tested admin source IP rule in place, apply changes during a maintenance window, use a bastion host, take snapshots, and change one layer at a time. Validate Security Group changes before applying restrictive Network ACL denies.

Q7: Can I expose MySQL or Redis to the public internet temporarily for migration?

A7: It is better to avoid that. Prefer a bastion host, private connectivity, or temporary IP-restricted access for the shortest possible window. If you must expose it briefly, restrict source IPs tightly and remove the rule immediately after migration.

Alibaba Cloud international rebate Optimization recommendations

Security optimization

• Use separate Security Groups for web, app, database, and bastion roles.
• Use Network ACLs to deny unwanted east-west traffic between subnets.
• Restrict SSH and RDP to fixed office or VPN IPs.
• Prefer HTTPS with valid SSL certificates for web exposure.
• Review account permissions so billing users cannot change network security and network users cannot alter payment settings unnecessarily.

Performance optimization

• Place tightly coupled application and database resources in the same region to reduce latency.
• Use private IP communication for app-to-db traffic.
• Benchmark bandwidth and latency before production cutover.
• Do not overload a low-spec ECS with logging, web traffic, and database roles on one host.

Cost optimization

• Use subscription for steady baseline workloads.
• Shut down or release temporary pay-as-you-go test instances promptly.
• Do not overprovision public bandwidth if traffic is small.
• Separate test and production resources so unused security labs do not keep running.

Alibaba Cloud international rebate Stability optimization

• Enable snapshots and regular backups before major network policy changes.
• Test ACL changes in a non-production subnet first.
• Enable renewal reminders and auto-renewal for critical resources.
• Keep a simple emergency access procedure documented: console login path, instance ID, public IP, admin IP source, and rollback rules.

If your priority is safe and reliable deployment, the best operational pattern on Alibaba Cloud is not to choose between Network ACLs and Security Groups, but to combine them with disciplined account setup, clean billing management, and staged validation. Most production issues in this area come from account and operations gaps just as often as they come from technical rule errors.