Before data communication is setup, the security groups match the security group rules one by...

Before data communication is set up, the security groups match the security group rules one by one to query whether to allow access requests. If the protocol type, port range, authorization type, and authorization object of two security group rules are the same, the following rules apply:

If the two rules have the same priority, the rule of the denial policy takes effect first, and the rule of the allowed policy does not take effect. This is because the security group rules follow the principle of minimum permission, which means that the most restrictive rule is applied when there is a conflict.

If the two rules have different priorities, the rule with a smaller priority number takes effect. This is because the security group rules follow the principle of priority, which means that the rule with a higher priority (lower number) is applied when there is a conflict. References: ECS Security Groups - Alibaba Fundamentals - Cloud Academy, Security group rules - Elastic Compute Service - Alibaba Cloud Documentation Center