Basic security groups support group-based authorization, allowing one security group ' s rules to reference another security group rather than requiring administrators to maintain long lists of individual IP addresses. Alibaba Cloud explicitly recommends source-security-group authorization for internal application communication because it is more manageable than maintaining individual private IP addresses or CIDR ranges.
This distinction is important because advanced security groups do not support another security group as an authorization object. Their primary benefit is higher private-IP capacity for very large deployments, not simplified service-to-service authorization.
For workloads residing in different VPCs, network connectivity must first exist through VPC Peering, Cloud Enterprise Network, PrivateLink, or another appropriate mechanism. Security groups do not themselves establish cross-VPC routes; they enforce authorization once the relevant network path exists.
Centralized logging provides visibility but does not simplify the actual authorization rules. Network ACLs operate at the vSwitch/subnet boundary and are less appropriate for application-tier identity based on security-group membership.
Thus, basic security groups with group-based authorization provide the intended simplified access-control model.
Study Guide reference: Securing Workloads on Alibaba Cloud — security groups, group-based authorization, least privilege, and VPC workload segmentation.
==================================================
