☁️ OpenStack Error: 'Security Group ... in use' SecurityGroupInUse on Delete

Exact Error Message

$ openstack security group delete web-sg
Security Group 3f2c1b9a-7d4e-4a1c-9b2e-6c8d0e1f2a3b in use.
Neutron server returns request_ids: ['req-8b1c4d2e-9f0a-4c3b-a2d1-5e6f7a8b9c0d']

The Neutron API log records the same condition as a SecurityGroupInUse exception:

neutron.api.v2.resource [req-8b1c4d2e-...] delete failed (client error):
  SecurityGroupInUse: Security Group 3f2c1b9a-... in use.

What It Means

A security group cannot be deleted while any Neutron port is still using it. Ports include instance NICs, router interfaces, DHCP ports, load-balancer VIPs, and floating-IP association ports. Neutron refuses the delete with an HTTP 409 (SecurityGroupInUse) to protect the traffic-filtering rules those ports depend on.

This is a referential-integrity guard, not a permissions or quota problem. The fix is to find every port that references the group, move those ports to a different security group (or delete the ports), and then retry the delete. The default security group of a project can never be deleted at all.

Common Causes

• One or more running instances still have a port bound to the security group.
• A port was left attached after an instance was deleted with a pre-created port (--nic port-id=...).
• The group is referenced by another security group’s rules as a remote_group_id.
• You are trying to delete the project’s default security group, which Neutron forbids.
• Automation deleted the server but not the port it explicitly created.

Diagnostic Commands

Confirm the group’s ID and that it is not the default group:

openstack security group show web-sg -f value -c id -c name

List every port that references the group. This is the authoritative check:

openstack port list --security-group web-sg -c id -c device_owner -c device_id -c fixed_ips

For each port, see what owns it (an instance, router, DHCP, or LB):

openstack port show <port-id> -c device_owner -c device_id -c binding_host_id

Check whether other security groups reference this one as a remote group:

openstack security group rule list -f value | grep <security-group-id>

Step-by-Step Resolution

1. List the ports still bound to the group so you know exactly what is holding it:

openstack port list --security-group web-sg

2. For an instance port, swap the instance onto a replacement group instead of the one you are deleting. Add the new group, then remove the old one:

openstack server add security group web-01 web-sg-v2
openstack server remove security group web-01 web-sg

3. For a bare port (a device_owner that is empty or compute:nova with no live server), reset its security groups directly:

openstack port set --no-security-group --security-group web-sg-v2 <port-id>

4. If another security group references this one via remote_group_id, delete or rewrite those rules first:

openstack security group rule delete <rule-id>

5. Re-run the port list and confirm it returns no rows:

openstack port list --security-group web-sg -f value -c id

6. Delete the now-unreferenced group:

openstack security group delete web-sg

7. If the group you need to remove is the project default, stop — it cannot be deleted. Empty its rules instead, or delete the whole project.

Prevention

• Detach or re-home ports before deleting a security group, not after; treat the group as a dependency of its ports.
• When you create ports explicitly in automation, delete those ports in the same teardown step as the server.
• Reference groups by name sparingly in remote_group_id rules; document the cross-references so cleanup order is obvious.
• Use distinct, versioned group names (web-sg-v2) during migrations so instances can be moved before the old group is removed.
• Audit orphaned ports periodically with openstack port list --device-owner '' to catch NICs left behind by deleted servers.

Related Errors

• SecurityGroupCannotRemoveDefault — attempting to delete a project’s default security group, which is never allowed.
• PortInUse / PortNotFound — port-level lifecycle errors rather than group references.
• Security group rule already exists — a duplicate rule (SecurityGroupRuleExists), not a delete conflict.
• Quota exceeded for resources: security_group — a creation-time quota problem, unrelated to deletion.

Frequently Asked Questions

How do I find what is using the security group? Run openstack port list --security-group <name> — every row is a port that must be re-homed or deleted before the group can go, and device_owner/device_id tell you whether it is an instance, router, or DHCP port.

Can I delete the default security group? No. Neutron blocks deletion of a project’s default group by design; you can only edit its rules or remove the entire project. For scripting these teardown steps, the OpenStack prompts library has ready-made cleanup workflows.

Why does it still say “in use” after I deleted the instance? If the instance was booted on a pre-created port, deleting the server leaves the port behind. Find it with openstack port list --security-group <name> and delete or reassign the port.

Does removing a group from a running instance drop connections? Neutron updates the port’s filtering rules live; existing flows may be affected by the new rule set, so add the replacement group before removing the old one to avoid a gap.

What if another security group references this one? A rule using remote_group_id counts as a reference. List rules with openstack security group rule list, delete the referencing rules, then retry. For more networking fixes, see the OpenStack guides.