Security Groups

A security group is a stateful firewall attached to instances and load balancers. Rules allow traffic; anything not explicitly allowed is denied. Because groups are stateful, return traffic for an allowed connection is permitted automatically — you don't add a matching reverse rule.

Create a group and rules

Create a group scoped to a VPC, then add rules. Each rule has:

• Direction — ingress (inbound) or egress (outbound).
• Protocol — tcp, udp, icmp, or any.
• Port range — e.g. 443, or a range (omit for ICMP / any).
• Source / destination — a CIDR (e.g. 0.0.0.0/0 for anywhere) or a reference to another security group (allow traffic from members of that group, handy for tiered apps).
• Action — allow (default) or deny, with a priority (lower wins).

fm network security-group create --name web --vpc my-vpc
fm network security-group add-rule web \
  --direction ingress --protocol tcp --port 443 --source 0.0.0.0/0

resource "frostmoln_security_group" "web" {
  vpc_id = frostmoln_vpc.main.id
  name   = "web"
}

resource "frostmoln_security_group_rule" "https" {
  security_group_id = frostmoln_security_group.web.id
  direction         = "ingress"
  protocol          = "tcp"
  port_range_min    = 443
  port_range_max    = 443
  remote_cidr       = "0.0.0.0/0"
}

Change an instance's security groups

You can replace the security groups on a running instance without recreating it. There are two scopes:

• Uniform (the common case) — one set applied to every network port of the instance.
• Per port — a different set on individual ports of a multi-NIC instance (e.g. a frontend NIC open to the internet and a management NIC that is not). Use this only when ports genuinely need to differ; otherwise use the uniform scope.

All three clients use replace semantics: the set you give becomes the complete set — any group not listed is removed.

Uniform (all ports)

In the portal, open the instance and edit the security groups on the Networking tab. With the CLI or Terraform:

# Replace the instance's groups across all ports (security-group IDs, not names)
fm compute instance security-groups set <instance-id> \
  --security-group <sg-id> --security-group <sg-id>

# Show the current groups (lists the per-port breakdown when ports differ)
fm compute instance security-groups get <instance-id>

resource "frostmoln_instance" "web" {
  # ... name, flavor, image, subnet ...
  security_groups = [
    frostmoln_security_group.web.id,
    frostmoln_security_group.ssh.id,
  ]
}

Per port (multi-NIC, differing sets)

The portal shows a per-port editor when an instance's ports carry different sets. Find the port ID in the ... security-groups get output (it lists the ports when they differ), then target one port — the others are left untouched.

# Target a single port by its port ID
fm compute instance security-groups set <instance-id> \
  --port <port-id> --security-group <sg-id>

resource "frostmoln_instance_port_security_groups" "frontend_nic" {
  instance_id     = frostmoln_instance.web.id
  port_id         = "b1e0f6c2-1234-4a5b-9c8d-abcdef012345" # the port ID from the per-port breakdown
  security_groups = [frostmoln_security_group.web.id]
}

Manage a given port through either frostmoln_instance.security_groups (uniform) or a per-port resource — not both.

Things to know

• The change is asynchronous. The portal and CLI return immediately and the update applies in the background — re-run ... security-groups get to confirm. terraform apply waits for the operation to finish.
• An empty set removes all groups, leaving the target on the VPC's default-drop (typically no inbound access). The CLI needs --clear for this; in Terraform set security_groups = [].
• Destroying a frostmoln_instance_port_security_groups resource does not strip the port's groups — it only stops Terraform managing them. To actually clear a port, set security_groups = [] and apply first, then remove the resource.
• A port with port security disabled rejects a non-empty set — you cannot attach groups to a port whose port security is turned off.

Good practice

• Open only the ports you need; prefer narrow source CIDRs over 0.0.0.0/0.
• Restrict SSH (22) to known administrative addresses.
• Model tiers by referencing groups — e.g. let the web group reach the db group on the database port, instead of using IP ranges.

Related

• VPCs · Compute / Instances