Security Group

A security group is a virtual firewall. Its rules say which traffic can reach a resource and which can leave it, by protocol, port, and source address. You write the rules once and attach the group to a node, autoscale group, Kubernetes cluster, load balancer, or database. A change to the rules then applies everywhere the group is attached.

Every node starts with one. Each account has a default security group per project and region, and a new node gets it unless you pick another group while creating the node. The default that E2E creates allows all traffic in and out, so a new node works straight away. When you want tighter control, such as SSH only from your office, you attach a group of your own.

Common uses are keeping SSH and RDP to trusted addresses, opening the web ports to everyone, and limiting a database port to your VPC.

Rules only ever allow traffic, and the groups on a node add up: traffic gets through when any one of them allows it. To narrow what reaches a node, attach your stricter group and then detach the group that allowed more.

A security group is separate from the Firewall product, which is a FortiGate appliance.

What you can do

Create and configure a group:

• Create a security group
• Add or edit rules

Attach and detach:

• Attach a security group to a node
• Detach a security group from a node
• Allow all traffic on a node temporarily

Manage the group:

• Set a security group as default
• Delete a security group

Where to start

Get started with Security Group sets up a group that lets SSH in from your own IP only and puts it on a node. If something does not behave as you expect, Troubleshooting Security Group lists the errors and their fixes.