Manage SSH keys and Security Groups

SSH keys decide who can sign in to the VMs of an Auto Scaling Group. The Security Group decides which traffic can reach them. Every VM of the group shares one set of SSH keys and one list of Security Groups.

Before you begin

• An SSH key in your account. To make one, see SSH Key Management.
• A Security Group in the same project and region as the group, with an inbound rule for port 22. To make one, see Create a security group.
• Permission to update VMs in the project, which covers attaching and detaching keys and Security Groups. See TIR Access Control.

Choose keys and a Security Group when you create a group

A group needs at least one SSH key and a Security Group that opens port 22. Both are under Network & Security on the create form.

1. Under SSH Keys, pick one key or several. If the key you need is missing, select Click here to add it; a key you add there is picked for you.
2. Under Security Group, pick a group that opens port 22. Once you have picked a key, you can choose only a group that opens port 22. If the current group blocks SSH, TIR switches to the default SSH Security Group.
3. Check the inbound rules of the group you chose.

The default Security Group allows SSH on port 22 from every address (0.0.0.0/0), and its rules are fixed. For stricter control, make your own Security Group that opens port 22 only to the addresses you trust.

Every VM of the group starts with the keys you picked, and the one Security Group covers every VM the group launches.

Public IP addresses

Every VM gets its own public IP address once it is ready, and its own private IP address. For one address that serves the whole group, connect a load balancer.

A public IP address is released when the VM is removed. The public address always opens port 22 for SSH, and it also opens the inbound port numbers of every attached Security Group. Only TCP traffic reaches a VM’s public address.

Change the SSH keys of a running group

1. In Auto Scaling Groups, select the group’s name, go to Network & Security, and select the SSH side tab.
2. Under Search label, pick the keys to attach.
3. Select Update. The keys reach every VM in the group.

To remove a key, select Detach on its row and confirm. The key stops working on every VM in the group, including running ones, and anyone connected with that key is locked out the next time they connect.

You can change keys only while the group is Running or Stopped. A group with no Security Group cannot take a key yet, so first select Attach a security group and follow the next section. SSH works only when a Security Group allows inbound TCP traffic on port 22. When the attached Security Groups keep port 22 closed, the tab warns you; attach a group that opens port 22.

Change the Security Groups of a running group

1. On the details page, go to Network & Security and select the Security Groups side tab. To make a new group first, select Click here.
2. Pick the groups to attach, up to 5 at a time.
3. Select Attach.

To detach a group, select its row’s detach button, tick “Are you sure you want to detach this security group?”, and select Detach. Detaching can affect the resources and network settings that rely on the group. While the group has SSH keys, it must keep at least one Security Group, so attach another before you detach the last one.

Sign in to a VM of the group

On the Overview tab, Connect has ssh root@<public IP> for up to three VMs, and VMs & Monitoring has the public IP address of every VM. Run the command in a terminal on your computer with the private key that matches an attached SSH key. A stopped group has no VMs to connect to.

Check the keys and groups

The attached key shows Attached on the SSH tab, and the attached Security Group shows Attached on the Security Groups tab. A command from Connect then opens a shell on the VM.

To watch the VMs and their addresses, see Monitor an Auto Scaling Group. To make a new group, see Create an Auto Scaling Group. For help with a refused change, see Troubleshooting TIR Auto Scaling Groups.