Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an Amazon EC2 instance running and I will like to add another security group to that instance and then remove the current security group from that instance. Is this possible?

share|improve this question
    
Just to add a few more bits of information. We have two instances joint to two security groups. We want to separate this and dedicate a security group per instance. –  Geo Jul 7 '09 at 15:25
add comment

6 Answers

up vote 29 down vote accepted

Amazon's FAQ says it's not possible to define a security group anywhere but at launch time.

share|improve this answer
1  
Thanks, I miss that question when I was browsing the FAQ. Thanks again. –  Geo Jul 7 '09 at 15:46
add comment
  1. Create an AMI image from the instance you want to move to a different security group.
  2. Launch a new instance using that image, now we can assign this new instance to a different security group.
  3. Discard the previous instance.

This requires downtime on your instance. There may be some other options available using the API.

share|improve this answer
add comment

As towo said you can't change a security group of an instance anywhere but launch time.

Unless you are using a VPC where security groups differ from EC2 security groups.

This page outlines the differences between EC2 and VPC security groups.

http://docs.amazonwebservices.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html

So if you require the extra functionality of the VPC groups (Changing groups, control ingress/engress traffic, etc.), you may want to look at the additional functionality provided by VPCs.

share|improve this answer
    
Welcome to Server Fault! Whilst this may theoretically answer the question, it would be preferable to include the essential parts of the answer here, and provide the link for reference. –  Scott Pack Nov 21 '12 at 0:55
add comment

It is now possible to do this. Click on the actions menu and Change Security Groups - Select the Security Groups you would like to use.

share|improve this answer
1  
Only in VPCs, I believe. –  ceejayoz Jan 8 at 14:00
    
It appears so. The "Change Security Groups" option is present in the menu but disabled for non-VPC instances. –  Alastair Irvine Jan 30 at 8:41
add comment

Update: As of January 2014, you can now change security groups for running AWS EC2 instances.

AWS Console

Simply right-click on an instance, and click on Change Security Group

Change Security Group

Add/remove security groups as appropriate and click Assign Security Groups when done

Select Security groups


EC2 Command Line

Use the following command

ec2-modify-instance-attribute <instance-id> --group-id <group-id>
share|improve this answer
    
The "Change Security Groups" option is present in the menu but disabled. I'm using region ap-southeast-2. –  Alastair Irvine Jan 30 at 8:45
    
this currently only applies to VPC instances. the security groups that a non-VPC instance belong to are fixed / immutable and are set when it's first launched. the only way to change them is to create a bundle from the existing instance and re-launch a new instance using the bundled ami. –  ives Apr 9 at 21:36
add comment

However according the this FAQ "modify the settings for the current security group - which will affect all instances running in the specific group" you can change gradually redefine the existing ones. As I'm trying this now for my scenario through the EC2 console, my records where all erased!

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.