Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have created a new EC2 instance. It got assigned the default security group. I want to change that security group. How?

share|improve this question
    
possible duplicate of How to add a security group to a running EC2 Instance? –  Iain Feb 19 '11 at 10:58
    
Not exactly. I STOP the instance but still cannot change the security group. But it appears that an instance's security group cannot be changed once the instance is launched, that is, if you assign security group secA to the instance, you cannot later change that instance's security group to secB. I have not found an AWS document that explicitly states this, though. –  user35042 Feb 19 '11 at 17:20
    
Documentation on the topic can be found here: docs.amazonwebservices.com/AWSEC2/latest/UserGuide/… (see the note under the "Adding a Security Group Rule" section) –  steenhulthin Mar 16 '12 at 9:13
    
Run it in a VPC. –  ceejayoz Sep 12 '13 at 15:29

5 Answers 5

up vote 58 down vote accepted

Unless the instance is in a VPC, security groups can only be chosen before you start your instance for the first time.

Only VPC instances can change security group. For information on VPC see here.

share|improve this answer
4  
As Vitaly says: "After an instance is running, you can't change which security groups it belongs to." (cited from the reference documentation). You could take a snapshot / AMI from the instance and launch it with a different security group, though. –  Axel Knauf Feb 21 '11 at 12:50
13  
Thanks for the reference, Axel. Although I know you are correct, the wording in the documentation is rather ambiguous: "After an instance is running, you can't change which security groups it belongs to." This suggested to me that if you stopped the instance you could then change the security group. A better way to word this would have been "After an instance has run for the first time, you can't change which security groups it belongs to." –  user35042 Feb 22 '11 at 6:40
1  
While you cannot change which security group is linked to the instance, you CAN edit the linked security group, and the changes take effect immediately, no need to restart the instance. –  romkyns May 4 at 2:50

It can be changed now http://elastic-security.com/2011/04/19/amazon-security-groups-vpc-vs-ec2/

share|improve this answer
11  
It can only be changed for VPC. –  steenhulthin Mar 16 '12 at 9:19

For instances launched without a VPC, the Security Group can only be specified at first launch, and cannot be changed afterwards, not even if the instance is stopped first.

For instances launched into a VPC, the group can be changed. However, not all instance types are supported in the VPC - for example, "micro" is not supported as of December 2011.

share|improve this answer

There is a way to accomplish this for an EBS-backed instance in a non-VPC environment, but it's a little painful:

  1. Shutdown the server you want to change.
  2. Right click the server and select Create Image to make an AMI from it.
  3. Once the AMI has been created, right click on the AMI and select Launch Instance.
  4. Choose the new security group as part of provisioning a "new" server.

This only works for EBS-backed instances that persist beyond a stop/start cycle.

share|improve this answer

According to the Amazon EC2 documentation, you can update the assigned security group.

After you launch an instance in EC2-Classic, you can't change its security groups. However, you can add rules to or remove rules from a security group, and those changes are automatically applied to all instances that are associated with the security group.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.