How Ocean handles security group updates

For nodes with IP persistence enabled, Ocean manages security groups on the persistent ENI during node resume.

When the node resumes:

• Security groups removed from the node configuration
  If the persistent ENI includes security groups that are no longer assigned to the node, Ocean removes those security groups from the ENI.

• Security groups added to the node configuration
  If the node configuration includes security groups that are not currently attached to the persistent ENI, Ocean adds those security groups to the ENI.
  
  

This reconciliation ensures that the persistent ENI always matches the node’s current security group configuration.

Why this matters

This behavior keeps network access consistent with your latest configuration while still preserving the node’s IP address. You do not need to manually update the ENI when security groups change, as Ocean handles this automatically when the node resumes.