diff --git a/pkg/util/aws/utils.go b/pkg/util/aws/utils.go
index bf52f0174a..45e842107f 100644
--- a/pkg/util/aws/utils.go
+++ b/pkg/util/aws/utils.go
@@ -5,6 +5,7 @@ import (
 	"net"
 	"reflect"
 	"regexp"
+	"sort"
 	"strings"
 
 	"github.com/aws/aws-sdk-go/service/ec2"
@@ -157,6 +158,34 @@ func IntVal(s *int64) int64 {
 	return 0
 }
 
+// SecurityRuleSet to  allow list
+// 将安全组规则全部转换为等价的allow规则
+func SecurityRuleSetToAllowSet(srs secrules.SecurityRuleSet) secrules.SecurityRuleSet {
+	inRuleSet := secrules.SecurityRuleSet{}
+	outRuleSet := secrules.SecurityRuleSet{}
+
+	for _, rule := range srs {
+		if rule.Direction == secrules.SecurityRuleIngress {
+			inRuleSet = append(inRuleSet, rule)
+		}
+
+		if rule.Direction == secrules.SecurityRuleEgress {
+			outRuleSet = append(outRuleSet, rule)
+		}
+	}
+
+	sort.Sort(inRuleSet)
+	sort.Sort(outRuleSet)
+
+	inRuleSet = inRuleSet.AllowList()
+	outRuleSet = outRuleSet.AllowList()
+
+	ret := secrules.SecurityRuleSet{}
+	ret = append(ret, inRuleSet...)
+	ret = append(ret, outRuleSet...)
+	return ret
+}
+
 func isAwsPermissionAllPorts(p ec2.IpPermission) bool {
 	if p.FromPort == nil || p.ToPort == nil {
 		return false
diff --git a/pkg/util/aws/vpc.go b/pkg/util/aws/vpc.go
index e4d18ca8ab..c12dbc2500 100644
--- a/pkg/util/aws/vpc.go
+++ b/pkg/util/aws/vpc.go
@@ -146,6 +146,7 @@ func (self *SRegion) SyncSecurityGroup(secgroupId string, vpcId string, name str
 		secgroupId = fmt.Sprintf("%s-%s", vpcId, secgroupId)
 	}
 
+	rules = SecurityRuleSetToAllowSet(rules)
 	if secgroup, err := self.getSecurityGroupById(vpcId, secgroupId); err != nil {
 		if len(desc) == 0 {
 			desc = fmt.Sprintf("security group %s for vpc %s", name, vpcId)