diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go
index 2f39f4f4a9..662074a02f 100644
--- a/pkg/compute/models/guests.go
+++ b/pkg/compute/models/guests.go
@@ -224,6 +224,15 @@ func (manager *SGuestManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQ
 		q = q.Equals("host_id", host.GetId())
 	}
 
+	secgrpFilter, _ := queryDict.GetString("secgroup")
+	if len(secgrpFilter) > 0 {
+		secgrp, _ := SecurityGroupManager.FetchByIdOrName("", secgrpFilter)
+		if secgrp == nil {
+			return nil, httperrors.NewResourceNotFoundError("secgroup %s not found", secgrpFilter)
+		}
+		q = q.Equals("secgrp_id", secgrp.GetId())
+	}
+
 	zoneFilter, _ := queryDict.GetString("zone")
 	if len(zoneFilter) > 0 {
 		zone, _ := ZoneManager.FetchByIdOrName("", zoneFilter)
@@ -1312,6 +1321,7 @@ func (self *SGuest) GetIsolatedDevices() []SIsolatedDevice {
 }
 
 func (self *SGuest) syncWithCloudVM(ctx context.Context, userCred mcclient.TokenCredential, host *SHost, extVM cloudprovider.ICloudVM) error {
+	metaData := extVM.GetMetadata()
 	diff, err := GuestManager.TableSpec().Update(self, func() error {
 		extVM.Refresh()
 		self.Name = extVM.GetName()
@@ -1333,6 +1343,16 @@ func (self *SGuest) syncWithCloudVM(ctx context.Context, userCred mcclient.Token
 		self.BillingType = extVM.GetBillingType()
 		self.ExpiredAt = extVM.GetExpiredAt()
 
+		if metaData != nil && metaData.Contains("secgroupId") {
+			if secgroupId, err := metaData.GetString("secgroupId"); err == nil && len(secgroupId) > 0 {
+				if secgrp, err := SecurityGroupManager.FetchByExternalId(secgroupId); err == nil && secgrp != nil {
+					self.SecgrpId = secgrp.GetId()
+				} else {
+					log.Errorf("Failed find secgroup %s for guest %s error: %v", secgroupId, self.Name, err)
+				}
+			}
+		}
+
 		return nil
 	})
 	if err != nil {
@@ -1345,9 +1365,9 @@ func (self *SGuest) syncWithCloudVM(ctx context.Context, userCred mcclient.Token
 			db.OpsLog.LogEvent(self, db.ACT_UPDATE, diffStr, userCred)
 		}
 	}
-	if metaData := extVM.GetMetadata(); metaData != nil {
+	if metaData != nil {
 		meta := make(map[string]string, 0)
-		if metaData.Unmarshal(meta); err != nil {
+		if err := metaData.Unmarshal(meta); err != nil {
 			log.Errorf("Get VM Metadata error: %v", err)
 		} else {
 			for key, value := range meta {
@@ -1386,12 +1406,24 @@ func (manager *SGuestManager) newCloudVM(ctx context.Context, userCred mcclient.
 	guest.HostId = host.Id
 	guest.ProjectId = userCred.GetProjectId()
 
+	metaData := extVM.GetMetadata()
+
+	if metaData != nil && metaData.Contains("secgroupId") {
+		if secgroupId, err := metaData.GetString("secgroupId"); err == nil && len(secgroupId) > 0 {
+			if secgrp, err := SecurityGroupManager.FetchByExternalId(secgroupId); err == nil && secgrp != nil {
+				guest.SecgrpId = secgrp.GetId()
+			} else {
+				log.Errorf("Failed find secgroup %s for guest %s error: %v", secgroupId, guest.Name, err)
+			}
+		}
+	}
+
 	err := manager.TableSpec().Insert(&guest)
 	if err != nil {
 		log.Errorf("Insert fail %s", err)
 	}
 
-	if metaData := extVM.GetMetadata(); metaData != nil {
+	if metaData != nil {
 		meta := make(map[string]string, 0)
 		if err := metaData.Unmarshal(meta); err != nil {
 			log.Errorf("Get VM Metadata error: %v", err)
diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go
index b0a0a82505..26da17d25e 100644
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -2,9 +2,9 @@ package models
 
 import (
 	"context"
+	"database/sql"
 	"strings"
 	"time"
-	"database/sql"
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
@@ -222,6 +222,12 @@ func (manager *SSecurityGroupManager) SyncSecgroups(ctx context.Context, userCre
 		}
 
 		for i := 0; i < len(added); i += 1 {
+			if metadata := added[i].GetMetadata(); metadata != nil && metadata.Contains("id") {
+				secgroupId, _ := metadata.GetString("id")
+				if secgrp, _ := manager.FetchById(secgroupId); secgrp != nil {
+					continue
+				}
+			}
 			if rules, err := added[i].GetRules(); err != nil {
 				syncResult.AddError(err)
 			} else if len(rules) > 0 {
@@ -354,4 +360,4 @@ func (manager *SSecurityGroupManager) InitializeData() error {
 		})
 	}
 	return nil
-}
\ No newline at end of file
+}
diff --git a/pkg/util/aliyun/instance.go b/pkg/util/aliyun/instance.go
index 5c26b7148b..f564167f00 100644
--- a/pkg/util/aliyun/instance.go
+++ b/pkg/util/aliyun/instance.go
@@ -163,6 +163,12 @@ func (self *SInstance) GetMetadata() *jsonutils.JSONDict {
 			data.Update(meta)
 		}
 	}
+	for _, secgroupId := range self.SecurityGroupIds.SecurityGroupId {
+		if len(secgroupId) > 0 {
+			data.Add(jsonutils.NewString(secgroupId), "secgroupId")
+			break
+		}
+	}
 
 	return data
 }
@@ -314,8 +320,8 @@ func (self *SInstance) GetHypervisor() string {
 }
 
 func (self *SInstance) StartVM() error {
-	timeout := 300*time.Second
-	interval := 15*time.Second
+	timeout := 300 * time.Second
+	interval := 15 * time.Second
 
 	startTime := time.Now()
 	for time.Now().Sub(startTime) < timeout {
@@ -781,4 +787,4 @@ func (self *SInstance) GetBillingType() string {
 
 func (self *SInstance) GetExpiredAt() time.Time {
 	return self.ExpiredTime
-}
\ No newline at end of file
+}
diff --git a/pkg/util/aliyun/securitygroup.go b/pkg/util/aliyun/securitygroup.go
index 3082451737..f873f2adac 100644
--- a/pkg/util/aliyun/securitygroup.go
+++ b/pkg/util/aliyun/securitygroup.go
@@ -46,6 +46,15 @@ type SPermissions struct {
 	Permission []SPermission
 }
 
+type Tags struct {
+	Tag []Tag
+}
+
+type Tag struct {
+	TagKey   string
+	TagValue string
+}
+
 type SSecurityGroup struct {
 	vpc               *SVpc
 	CreationTime      time.Time
@@ -56,6 +65,7 @@ type SSecurityGroup struct {
 	InnerAccessPolicy string
 	Permissions       SPermissions
 	RegionId          string
+	Tags              Tags
 }
 
 type PermissionSet []SPermission
@@ -78,7 +88,14 @@ func (v PermissionSet) Less(i, j int) bool {
 }
 
 func (self *SSecurityGroup) GetMetadata() *jsonutils.JSONDict {
-	return nil
+	if len(self.Tags.Tag) == 0 {
+		return nil
+	}
+	data := jsonutils.NewDict()
+	for _, value := range self.Tags.Tag {
+		data.Add(jsonutils.NewString(value.TagValue), value.TagKey)
+	}
+	return data
 }
 
 func (self *SSecurityGroup) GetId() string {