diff --git a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md
index 132b4fb2110..e27d2fdf17a 100644
--- a/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md
+++ b/content/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/_index.md
@@ -24,7 +24,7 @@ Use {{< product >}} to create a Kubernetes cluster in Amazon EC2.
 
         See [Example Node IAM policy](#example-node-iam-policy) for an example policy that can be applied to these credentials.
 	- **Zone and Network** configures the availability zone and network settings for your cluster.
-    - **Security Groups** creates or configures the security groups applied to your nodes.
+    - **Security Groups** creates or configures the Security Groups applied to your nodes. Please refer to [Amazon EC2 security group when using Node Driver]({{< baseurl >}}/rancher/v2.x/en/installation/references/#amazonec2-securitygroup-nodedriver) to see what rules are created in the `rancher-nodes` Security Group.
     - **Instance** configures the instances that will be created. Make sure you configure the correct **SSH User** for the configured AMI.
 
     If you need to pass an **IAM Instance Profile Name** (not ARN), for example, when you want to use a [Kubernetes Cloud Provider]({{< baseurl >}}/rancher/v2.x/en/cluster-provisioning/rke-clusters/options/cloud-providers), you will need an additional permission in your policy. See [Example Node IAM policy with PassRole](#example-node-iam-policy-with-passrole) for an example policy.
diff --git a/content/rancher/v2.x/en/installation/references/_index.md b/content/rancher/v2.x/en/installation/references/_index.md
index d57a9eab855..840bd550840 100644
--- a/content/rancher/v2.x/en/installation/references/_index.md
+++ b/content/rancher/v2.x/en/installation/references/_index.md
@@ -13,3 +13,4 @@ The following diagram displays the basic port requirements for Rancher. If you n
 
 {{< requirements_ports_rancher >}}
 {{< requirements_ports_rke >}}
+{{< ports_aws_securitygroup_nodedriver >}}
diff --git a/layouts/shortcodes/ports_aws_securitygroup_nodedriver.html b/layouts/shortcodes/ports_aws_securitygroup_nodedriver.html
new file mode 100644
index 00000000000..9f45ef205ae
--- /dev/null
+++ b/layouts/shortcodes/ports_aws_securitygroup_nodedriver.html
@@ -0,0 +1,103 @@
+    <h3 id="amazonec2-securitygroup-nodedriver">Amazon EC2 security group when using Node Driver</h3>
+    <p>If you are <a href="/rancher/v2.x/en/cluster-provisioning/rke-clusters/node-pools/ec2/">Creating an Amazon EC2 Cluster</a>, you can choose to let Rancher create a Security Group called <code>rancher-nodes</code>. The following rules are automatically added to this Security Group.
+    </p>
+<div>	
+	<p><strong>Security group: rancher-nodes</strong></p>
+	<h4>Inbound rules</h4>
+	<table>
+	    <tr>
+	        <th>Type</th>
+	        <th>Protocol</th>
+	        <th align="left">Port Range</th>
+	        <th align="left">Source</th>
+	    </tr>
+            <tr>
+                <td>SSH</td>
+                <td>TCP</td>
+                <td>22</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+            <tr>
+                <td>HTTP</td>
+                <td>TCP</td>
+                <td>80</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>443</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>2376</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>2379-2380</td>
+                <td>sg-xxx (rancher-nodes)</td>
+            </tr>
+            <tr>
+                <td>Custom UDP Rule</td>
+                <td>UDP</td>
+                <td>4789</td>
+                <td>sg-xxx (rancher-nodes)</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>6443</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+            <tr>
+                <td>Custom UDP Rule</td>
+                <td>UDP</td>
+                <td>8472</td>
+                <td>sg-xxx (rancher-nodes)</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>10250-10252</td>
+                <td>sg-xxx (rancher-nodes)</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>10256</td>
+                <td>sg-xxx (rancher-nodes)</td>
+            </tr>
+            <tr>
+                <td>Custom TCP Rule</td>
+                <td>TCP</td>
+                <td>30000-32767</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+            <tr>
+                <td>Custom UDP Rule</td>
+                <td>UDP</td>
+                <td>30000-32767</td>
+                <td>0.0.0.0/0</td>
+            </tr>
+	</table>
+	<h4>Outbound rules</h4>
+	<table>
+	    <tr>
+	        <th>Type</th>
+	        <th>Protocol</th>
+	        <th align="left">Port Range</th>
+	        <th align="left">Destination</th>
+	    </tr>
+	    <tr>
+		<td>All traffic</td>
+	        <td>All</td>
+	        <td>All</td>
+	        <td>0.0.0.0/0</td>
+	    </tr>
+	</table>
+    <br/>
+</div>