Attach or detach a security group

Attach a security group to a resource to apply its rules there, and detach it to take those rules off again.

Before you begin

You need Update permission on the resource, and a security group; see Create a security group. You attach and detach groups only from the resource’s own screen. The same controls appear on an instance, an inference service, and a Slurm cluster.

The ports open on a resource are the ports in the inbound rules of its security groups. SSH needs a group with an inbound rule for port 22; see Connect to an instance over SSH.

Attach security groups

1. Open the resource, and open its security group screen. On an instance, this is the Security Groups tab under Network & Security.
2. Open Select Security Groups and choose one or more groups. You can choose any group except those already marked Attached. If you have Create permission on security groups, a link under the heading opens the page to create a new group.
3. Select Attach.

You can attach up to five groups at a time.

Detach a security group

1. In the same screen, find the group in the list. Select it to see its Inbound Rules and Outbound Rules.
2. Select the detach button in the group’s row.
3. In Detach Security Group, read the warning about the effect on the resource and its network setup. Tick “Are you sure you want to detach this security group?” and select Detach.

Keep at least one security group on an instance that has SSH turned on. While an instance has any security group attached, keep at least one public IP on it too.

See the groups on a resource

The list shows the groups now on the resource, and each group’s Associated Services tab on the Security Groups page lists the same resource.

The resource follows the rules of the attached groups. The rules of Default-SSH-Security-Group are fixed. For help with a refused change, see Troubleshooting Security Groups.