diff --git a/pkg/util/aws/securitygroup.go b/pkg/util/aws/securitygroup.go
index 7d2c3d8975..b024596f10 100644
--- a/pkg/util/aws/securitygroup.go
+++ b/pkg/util/aws/securitygroup.go
@@ -108,6 +108,7 @@ func (self *SRegion) addSecurityGroupRules(secGrpId string, rule *secrules.Secur
 
 func (self *SRegion) addSecurityGroupRule(secGrpId string, rule *secrules.SecurityRule) error {
 	ipPermissions, err := YunionSecRuleToAws(*rule)
+	log.Debugf("Aws security group rule: %s", ipPermissions)
 	if err != nil {
 		return err
 	}
diff --git a/pkg/util/aws/utils.go b/pkg/util/aws/utils.go
index 2e4e1a8da4..6db4151d9d 100644
--- a/pkg/util/aws/utils.go
+++ b/pkg/util/aws/utils.go
@@ -174,6 +174,14 @@ func awsProtocolToYunion(p ec2.IpPermission) string {
 	}
 }
 
+func yunionProtocolToAws(r secrules.SecurityRule) string {
+	if r.Protocol == secrules.PROTO_ANY {
+		return "-1"
+	} else {
+		return r.Protocol
+	}
+}
+
 func isYunionRuleAllPorts(r secrules.SecurityRule) bool {
 	//  全部端口范围： TCP/UDP （0，65535）    其他：（-1，-1）
 	if (r.Protocol == "tcp" || r.Protocol == "udp") && r.PortStart == 0 && r.PortEnd == 65535 {
@@ -300,11 +308,12 @@ func YunionSecRuleToAws(rule secrules.SecurityRule) ([]*ec2.IpPermission, error)
 	ipranges = append(ipranges, &ec2.IpRange{CidrIp: &iprange, Description: &rule.Description})
 
 	portranges := yunionPortRangeToAws(rule)
+	protocol := yunionProtocolToAws(rule)
 	permissions := []*ec2.IpPermission{}
 	for _, port := range portranges {
 		permission := ec2.IpPermission{
 			FromPort:   &port.Start,
-			IpProtocol: &rule.Protocol,
+			IpProtocol: &protocol,
 			IpRanges:   ipranges,
 			ToPort:     &port.End,
 		}
diff --git a/pkg/util/aws/vpc.go b/pkg/util/aws/vpc.go
index a695eb7f55..21c3ec6eee 100644
--- a/pkg/util/aws/vpc.go
+++ b/pkg/util/aws/vpc.go
@@ -1,6 +1,7 @@
 package aws
 
 import (
+	"fmt"
 	"github.com/aws/aws-sdk-go/service/ec2"
 	"strings"
 	"yunion.io/x/jsonutils"
@@ -141,12 +142,18 @@ func (self *SVpc) GetIWireById(wireId string) (cloudprovider.ICloudWire, error)
 func (self *SVpc) SyncSecurityGroup(secgroupId string, name string, rules []secrules.SecurityRule) (string, error) {
 	secgrpId := ""
 	if secgroup, err := self.region.getSecurityGroupByTag(self.VpcId, secgroupId); err != nil {
-		if secgrpId, err = self.region.createSecurityGroup(self.VpcId, name, ""); err != nil {
+		// 名称为default的安全组与aws默认安全组名冲突
+		if strings.ToLower(name) == "default" {
+			name = fmt.Sprintf("%s-%s", self.VpcId, name)
+		}
+
+		desc := fmt.Sprintf("security group %s for vpc %s", name, self.VpcId)
+		if secgrpId, err = self.region.createSecurityGroup(self.VpcId, name, desc); err != nil {
 			return "", err
 		}
 
 		//addRules
-		log.Debugf("Add Rules for %s", secgrpId)
+		log.Debugf("Add Rules for %s : %s", secgrpId, rules)
 		for _, rule := range rules {
 			if err := self.region.addSecurityGroupRule(secgrpId, &rule); err != nil {
 				return "", err