E2E CloudSecurity Groups FAQ
What does the default security group allow?
Section titled “What does the default security group allow?”Default-SSH-Security-Group allows SSH (port 22) from any network and all outbound traffic. This group is fixed. For other access, create your own group with the rules you need. See Security groups and rules.
How do I limit SSH to my own address?
Section titled “How do I limit SSH to my own address?”Create a security group with an inbound SSH rule whose Source is Manual Network, with your own address in IP Address. Add an outbound rule too, then attach the group to the resource instead of the default group. See Create a security group.
Which resources use security groups?
Section titled “Which resources use security groups?”Instances, VMs, inference services, and Slurm clusters. You attach a group from the resource’s own screen. See Attach or detach a security group and, for a VM, Attach security groups to a VM.
Which ports can a rule open?
Section titled “Which ports can a rule open?”Ports 22, 80, 443, and 1024 to 65535. Add each port on its own: the field takes one port at a time, and a hyphenated range is refused. See Manage security group rules.
Can an inbound rule allow all traffic?
Section titled “Can an inbound rule allow all traffic?”No. An inbound rule is Custom TCP or SSH, with the ports you list. All Traffic is for outbound rules.
Can a rule allow a whole address range?
Section titled “Can a rule allow a whole address range?”No. Manual Network takes one IPv4 address, and the rule covers that address only. Add a rule for each address, or use MyAccount VPC Network to allow a MyAccount VPC.
Do rule changes reach resources that already have the group?
Section titled “Do rule changes reach resources that already have the group?”Yes. Resources that have the group attached pick up the new rules in the background. See Apply the changes.
Does a group need both inbound and outbound rules?
Section titled “Does a group need both inbound and outbound rules?”Yes. A group keeps at least one inbound rule and one outbound rule at all times.
Can I delete a security group that is attached?
Section titled “Can I delete a security group that is attached?”Yes, unless it is the only group on an instance with SSH keys or on an inference service with a reserved IP. Those resources need a group attached. Once the group is deleted, the resources that had it stop following its rules. See Delete a security group.
How many security groups can I attach at once?
Section titled “How many security groups can I attach at once?”Up to five at a time. See Attach or detach a security group.
Are security groups charged?
Section titled “Are security groups charged?”No. Creating a group, changing its rules, and attaching it are free. See Security groups and rules.