---
title: "Create a security group"
description: "Create a TIR security group with a name, a description, and the inbound and outbound rules that decide what traffic your resources accept and send."
content_type: "how-to"
product: "tir-security-group"
platform: "TIR"
url: "/tir/tir-security-group/how-to/create-a-security-group/"
topic: ["security-groups"]
---

# Create a security group

A security group holds the inbound and outbound rules for traffic. Create one with at least one
inbound and one outbound rule, then attach it to an instance, an inference service, or a Slurm
cluster.

## Before you begin

You need a role with Create permission on security groups. Every project already has a default
group, **Default-SSH-Security-Group**, that allows SSH from any network and all outbound traffic.
You can use it as it is, or create a group when you need tighter rules; see
[Security groups and rules](/tir/tir-security-group/concepts/security-groups/). A security group
belongs to one project and one region.

## Open the create page

In TIR, open your project. In the side menu, under **PLATFORM SERVICES**, select **Networking**,
then **Security Groups**. The page lists the groups of the project. Select
**Create Security Group**.

## Name the group

In **Security Group Name**, keep the suggested name or type your own. A name has 1 to 255
characters: letters, digits, hyphens, and underscores. Choose a name that no other group in the
project and region uses. **Description** is optional and holds up to 500 characters.

## Add the rules

A group needs at least one inbound rule and at least one outbound rule. Each section is marked
**Required** until it has a rule. In **Inbound Rules** and then **Outbound Rules**, fill in the rule
form and select **Add Rule**. The form is the same as when you
[manage the rules of an existing group](/tir/tir-security-group/how-to/manage-security-group-rules/):

- **Type**. Inbound offers **Custom TCP** and **SSH**. Outbound offers **All Traffic**,
  **Custom TCP**, and **SSH**. **SSH** fills port 22 for you, and **All Traffic** takes no ports.
- **Protocol**. **TCP** for **Custom TCP** and **SSH**, **All** for **All Traffic**.
- **Ports**. Type a port and press Space or a comma to add it. You can use 22, 80, 443, and 1024
  to 65535.
- **Source** for an inbound rule, **Destination** for an outbound rule: **Any Network**,
  **Manual Network**, or, for an inbound rule only, **MyAccount VPC Network**.
- **Description (Optional)**.

Each rule you add is listed with a **NEW** label. To drop a rule before you create the group,
select **Remove** next to it.

## Create the group

Select **Create Security Group**. It is available once the group has both an inbound and an
outbound rule.

## Find the new group

The new group is listed with its rule counts. Select it to see its
**Overview**, **Inbound Rules**, **Outbound Rules**, and **Associated Services** tabs.

The group is free, and its rules take effect once you
[attach it to a resource](/tir/tir-security-group/how-to/attach-or-detach-a-security-group/). For
help with a refused group, see
[Troubleshooting Security Groups](/tir/tir-security-group/troubleshooting/tir-security-group/).