Security groups and rules

A security group is a virtual firewall for your TIR resources. Its rules say which inbound and outbound traffic is allowed, so you control network access to your instances, VMs, inference services, and Slurm clusters. A security group belongs to one project and one region.

What a rule holds

Each group has inbound rules, for traffic coming to your resources, and outbound rules, for traffic leaving them. A rule has a Type, a Protocol, Ports, a Source (inbound) or Destination (outbound), and an optional Description.

• Inbound Type is Custom TCP or SSH. Outbound is All Traffic, Custom TCP, or SSH.
• Ports are 22, 80, 443, and 1024 to 65535. SSH is port 22.
• Source or Destination is Any Network or Manual Network, which takes one IPv4 address. An inbound rule can also use MyAccount VPC Network, which outbound rules do not offer.

A group must keep at least one inbound and one outbound rule. When you change a group’s rules, the resources that have it attached pick up the change in the background. The steps are in Manage security group rules.

The default group

Every project has a group named Default-SSH-Security-Group in each region. It has an inbound rule allowing SSH (port 22) from any network and an outbound rule allowing all traffic. You can use it at once when you create an instance, or create more groups for tighter access. The default group is marked SSH Default and stays as it is: you cannot edit it, change its rules, or delete it. To limit SSH to your own address, create a group with an inbound SSH rule from a Manual Network address and attach it instead.

The group details

Select a group in the Security Groups list to see four tabs.

Tab	Shows
Overview	The name, the description, the type (SSH Default Security Group or Custom Security Group), and who created it.
Inbound Rules	Each inbound rule with its type, protocol, ports, source, and description.
Outbound Rules	Each outbound rule with its type, protocol, ports, destination, and description.
Associated Services	The instances and inference endpoints that have the group attached.

Rules for common setups

Each setup below keeps one outbound rule of Type All Traffic to Any Network, so the resource can reach the internet, and adds the inbound rules shown.

Setup	Inbound rules
SSH from your own address only	SSH, Source Manual Network, with your public IPv4 address in IP Address
A website or web app	Custom TCP on ports 80 and 443 from Any Network, plus an SSH rule if you sign in over SSH
An app or API on its own port	Custom TCP on that port, such as 8000, from Any Network or from one Manual Network address
Traffic from your MyAccount VPC only	Custom TCP on the app’s port, Source MyAccount VPC Network, with the MyAccount region, project, and VPC chosen

Open only the ports a resource needs. Name each group for its purpose, such as ssh-access, web-server, or inference-internal, so the right one is easy to pick. Review the rules from time to time and keep only the ones still in use. For SSH-only access from anywhere, the default group is ready to use.

Billing

Security groups are free of charge, whether you create one, change its rules, or attach it to a resource.

What you can do

Create a security group, manage its rules, edit it, attach or detach it, or delete it.