---
title: "Attach or detach a security group"
description: "Attach up to five security groups at a time to an instance, an inference service, or a Slurm cluster, and detach one when you are done with it."
content_type: "how-to"
product: "tir-security-group"
platform: "TIR"
url: "/tir/tir-security-group/how-to/attach-or-detach-a-security-group/"
topic: ["security-groups"]
relationships: {"requires":["/tir/tir-security-group/how-to/create-a-security-group/"]}
---

# Attach or detach a security group

Attach a security group to a resource to apply its rules there, and detach it to take those rules
off again.

## Before you begin

You need Update permission on the resource, and a security group; see
[Create a security group](/tir/tir-security-group/how-to/create-a-security-group/). You attach and
detach groups only from the resource's own screen. The same
controls appear on an instance, an inference service, and a Slurm cluster.

The ports open on a resource are the ports in the inbound rules of its security groups. SSH needs a
group with an inbound rule for port 22; see
[Connect to an instance over SSH](/tir/tir-instance/how-to/connect-to-an-instance-over-ssh/).

## Attach security groups

1. Open the resource, and open its security group screen. On an instance, this is the
   **Security Groups** tab under **Network & Security**.
2. Open **Select Security Groups** and choose one or more groups. You can choose any group except
   those already marked **Attached**. If you have Create permission on security groups, a link under
   the heading opens the page to create a new group.
3. Select **Attach**.

You can attach up to five groups at a time.

## Detach a security group

1. In the same screen, find the group in the list. Select it to see its **Inbound Rules** and
   **Outbound Rules**.
2. Select the detach button in the group's row.
3. In **Detach Security Group**, read the warning about the effect on the resource and its network
   setup. Tick "Are you sure you want to detach this security group?" and select **Detach**.

Keep at least one security group on an instance that has SSH turned on. While an instance has any security
group attached, keep at least one public IP on it too.

## See the groups on a resource

The list shows the groups now on the resource, and each group's **Associated Services** tab on the
**Security Groups** page lists the same resource.

The resource follows the rules of the attached groups. The rules of **Default-SSH-Security-Group**
are fixed. For help with a refused change, see
[Troubleshooting Security Groups](/tir/tir-security-group/troubleshooting/tir-security-group/).