diff --git a/CHANGELOG.md b/CHANGELOG.md
index fec1c4f..57c9ff8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,6 +1,7 @@
 ## 1.1.0 (Unreleased)
 
 * Provider image family data [GH-9]
+* Support set of Security Group IDs on the instance [GH-36]
 
 ## 1.0.0 (June 14, 2021)
 
diff --git a/builder/yandex/common_config.go b/builder/yandex/common_config.go
index 88a304d..79ce92a 100644
--- a/builder/yandex/common_config.go
+++ b/builder/yandex/common_config.go
@@ -109,6 +109,8 @@ type NetworkConfig struct {
 	SubnetID string `mapstructure:"subnet_id" required:"false"`
 	// The name of the zone to launch the instance.  This defaults to `ru-central1-a`.
 	Zone string `mapstructure:"zone" required:"false"`
+	// Security group ids for network interface of the instance.
+	SecurityGroupIds []string `mapstructure:"security_group_ids" required:"false"`
 
 	// If set to true, then launched instance will have external internet
 	// access.
diff --git a/builder/yandex/config.hcl2spec.go b/builder/yandex/config.hcl2spec.go
index af9c414..40504db 100644
--- a/builder/yandex/config.hcl2spec.go
+++ b/builder/yandex/config.hcl2spec.go
@@ -88,6 +88,7 @@ type FlatConfig struct {
 	DiskLabels                map[string]string `mapstructure:"disk_labels" required:"false" cty:"disk_labels" hcl:"disk_labels"`
 	SubnetID                  *string           `mapstructure:"subnet_id" required:"false" cty:"subnet_id" hcl:"subnet_id"`
 	Zone                      *string           `mapstructure:"zone" required:"false" cty:"zone" hcl:"zone"`
+	SecurityGroupIds          []string          `mapstructure:"security_group_ids" required:"false" cty:"security_group_ids" hcl:"security_group_ids"`
 	UseIPv4Nat                *bool             `mapstructure:"use_ipv4_nat" required:"false" cty:"use_ipv4_nat" hcl:"use_ipv4_nat"`
 	UseIPv6                   *bool             `mapstructure:"use_ipv6" required:"false" cty:"use_ipv6" hcl:"use_ipv6"`
 	UseInternalIP             *bool             `mapstructure:"use_internal_ip" required:"false" cty:"use_internal_ip" hcl:"use_internal_ip"`
@@ -196,6 +197,7 @@ func (*FlatConfig) HCL2Spec() map[string]hcldec.Spec {
 		"disk_labels":                  &hcldec.AttrSpec{Name: "disk_labels", Type: cty.Map(cty.String), Required: false},
 		"subnet_id":                    &hcldec.AttrSpec{Name: "subnet_id", Type: cty.String, Required: false},
 		"zone":                         &hcldec.AttrSpec{Name: "zone", Type: cty.String, Required: false},
+		"security_group_ids":           &hcldec.AttrSpec{Name: "security_group_ids", Type: cty.List(cty.String), Required: false},
 		"use_ipv4_nat":                 &hcldec.AttrSpec{Name: "use_ipv4_nat", Type: cty.Bool, Required: false},
 		"use_ipv6":                     &hcldec.AttrSpec{Name: "use_ipv6", Type: cty.Bool, Required: false},
 		"use_internal_ip":              &hcldec.AttrSpec{Name: "use_internal_ip", Type: cty.Bool, Required: false},
diff --git a/builder/yandex/step_create_instance.go b/builder/yandex/step_create_instance.go
index f773389..0cbf80f 100644
--- a/builder/yandex/step_create_instance.go
+++ b/builder/yandex/step_create_instance.go
@@ -252,6 +252,7 @@ func (s *StepCreateInstance) Run(ctx context.Context, state multistep.StateBag)
 			{
 				SubnetId:             instanceSubnetID,
 				PrimaryV4AddressSpec: &compute.PrimaryAddressSpec{},
+				SecurityGroupIds:     config.SecurityGroupIds,
 			},
 		},
 	}
diff --git a/docs-partials/builder/yandex/NetworkConfig-not-required.mdx b/docs-partials/builder/yandex/NetworkConfig-not-required.mdx
index 072696b..f24b98d 100644
--- a/docs-partials/builder/yandex/NetworkConfig-not-required.mdx
+++ b/docs-partials/builder/yandex/NetworkConfig-not-required.mdx
@@ -6,6 +6,8 @@
 
 - `zone` (string) - The name of the zone to launch the instance.  This defaults to `ru-central1-a`.
 
+- `security_group_ids` ([]string) - Security group ids for network interface of the instance.
+
 - `use_ipv4_nat` (bool) - If set to true, then launched instance will have external internet
   access.
 
diff --git a/post-processor/yandex-export/post-processor.hcl2spec.go b/post-processor/yandex-export/post-processor.hcl2spec.go
index a21fbe0..4c2ddfd 100644
--- a/post-processor/yandex-export/post-processor.hcl2spec.go
+++ b/post-processor/yandex-export/post-processor.hcl2spec.go
@@ -40,6 +40,7 @@ type FlatConfig struct {
 	DiskLabels                map[string]string        `mapstructure:"disk_labels" required:"false" cty:"disk_labels" hcl:"disk_labels"`
 	SubnetID                  *string                  `mapstructure:"subnet_id" required:"false" cty:"subnet_id" hcl:"subnet_id"`
 	Zone                      *string                  `mapstructure:"zone" required:"false" cty:"zone" hcl:"zone"`
+	SecurityGroupIds          []string                 `mapstructure:"security_group_ids" required:"false" cty:"security_group_ids" hcl:"security_group_ids"`
 	UseIPv4Nat                *bool                    `mapstructure:"use_ipv4_nat" required:"false" cty:"use_ipv4_nat" hcl:"use_ipv4_nat"`
 	UseIPv6                   *bool                    `mapstructure:"use_ipv6" required:"false" cty:"use_ipv6" hcl:"use_ipv6"`
 	UseInternalIP             *bool                    `mapstructure:"use_internal_ip" required:"false" cty:"use_internal_ip" hcl:"use_internal_ip"`
@@ -132,6 +133,7 @@ func (*FlatConfig) HCL2Spec() map[string]hcldec.Spec {
 		"disk_labels":                  &hcldec.AttrSpec{Name: "disk_labels", Type: cty.Map(cty.String), Required: false},
 		"subnet_id":                    &hcldec.AttrSpec{Name: "subnet_id", Type: cty.String, Required: false},
 		"zone":                         &hcldec.AttrSpec{Name: "zone", Type: cty.String, Required: false},
+		"security_group_ids":           &hcldec.AttrSpec{Name: "security_group_ids", Type: cty.List(cty.String), Required: false},
 		"use_ipv4_nat":                 &hcldec.AttrSpec{Name: "use_ipv4_nat", Type: cty.Bool, Required: false},
 		"use_ipv6":                     &hcldec.AttrSpec{Name: "use_ipv6", Type: cty.Bool, Required: false},
 		"use_internal_ip":              &hcldec.AttrSpec{Name: "use_internal_ip", Type: cty.Bool, Required: false},