Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We have some security groups that have quite a few rules in them. Rather than having to recreate the same rules for a number of security groups just to accommodate minor differences, is it possible to copy a security group to use as a starting point, or use inheritance, etc?

share|improve this question
You can apply multiple security groups to a single resource. Making a copy of a security group seems like a bad idea. Just add the new rules to a new group and apply it to the right instances. – Ladadadada May 23 '13 at 6:51
I just tried searching for this info but cant find anything that shows how to add additional security groups to a singe EC2 instance. Can you provide a link? – BillR May 23 '13 at 21:07
I just wrote a new function in a Python Boto class library I slowly add to. A PITA I shouldn't have had to deal with (as are a lot of things) but at least now I have a simpler and more straight forward interface to do this than anything else I've seen. – BillR Aug 22 '13 at 17:02

Doesn't look like you can copy security groups from the web interface. You can however use the AWS CLI to create security groups:

Command :

$ aws ec2 describe-security-groups --group-names MySecurityGroup

Output :

    "securityGroupInfo": [
            "ipPermissionsEgress": [],
            "groupId": "sg-903004f8",
            "ipPermissions": [],
            "groupName": "MySecurityGroup",
            "ownerId": "803981987763",
            "groupDescription": "AWS-CLI-Example"
    "requestId": "afb680df-d7b1-4f6a-b1a7-344fdb1e3532"

And add rules using command :

aws ec2 authorize-security-group-ingress --group-name MySecurityGroup --ip-protocol tcp --from-port 22 --to-port 22 --cidr-ip


    "return": "true",
    "requestId": "c24a1c93-150b-4a0a-b56b-b149c0e660d2"

From there you should be able to figure out how to simplify the creation of your security groups.

share|improve this answer
yeah I figured this was the route that would need to be taken... was thinking about doing something similar to this using boto too. Thanks for the example... will give you the thumbs up for it. Thanks. – BillR May 23 '13 at 0:12

Consider having a look at this blog. It might be useful for what you are looking at.

share|improve this answer
I wrote some Python Boto stuff to do this. Easier to use than anything I've seen. – BillR Aug 22 '13 at 17:14
please summarize the contents of your link – Ward Aug 23 '13 at 3:26
up vote 2 down vote accepted

Here is the 'copy security groups' python/boto method from a custom library I wrote to make these kinds of things easier / automate them.. Ultimately this was the solution I came up with.

vpcId is the Virtual Private Cloud Id
keys is a dictionary with your AWS keys

The rest should be straight forward to figure out.

def copyEC2SecurityGroup(self, keys, region, securityGroupName, newSecurityGroupName = None, newRegion = None, vpcId = None):

newEc2Connection = None
print("Creating ec2Connection for source region: " + region)
ec2Connection = lib.getEc2Connection(region, keys)

if newRegion is None:
    newRegion = region
    print("New Region Detected, creating for New region: " + newRegion)
    newEc2Connection = lib.getEc2Connection(newRegion, keys)
    newRegionInfo = newEc2Connection.region

print("new region is: %s" % newRegion)

if newSecurityGroupName is None:
    newSecurityGroupName = securityGroupName

print ("new security group is: %s" % newSecurityGroupName)

# if copying in the same region the new security group cannot have the same name.
if newRegion == region:
    if newSecurityGroupName == securityGroupName:
        print ("Old and new security groups cannot have the same name when copying to the same region.")

groups = [group for group in ec2Connection.get_all_security_groups() if == securityGroupName]
print"got groups count " + str(len(groups))
if groups:
    theOldGroup = groups[0]
    print theOldGroup.rules
    print("Can't find security group by the name of: %s" % securityGroupName)
print groups

if newEc2Connection is not None:
    print("Creating new security group in new region")
    sg = newEc2Connection.create_security_group(newSecurityGroupName, newSecurityGroupName, vpcId)
    print("Creating new security group in current region")
    sg = ec2Connection.create_security_group(newSecurityGroupName, newSecurityGroupName, vpcId)

source_groups = []
for rule in theOldGroup.rules:
    for grant in rule.grants:
        strGrant = str(grant)
        if strGrant.startswith("sg"):
            print("Cannot copy 'security group rule' (%s)... only cidr_ip's e.g." % strGrant)
        grant_nom = or grant.group_id
        if grant_nom:
            if grant_nom not in source_groups:
                sg.authorize(rule.ip_protocol, rule.from_port, rule.to_port, grant)
            sg.authorize(rule.ip_protocol, rule.from_port, rule.to_port, grant.cidr_ip)
return sg 
share|improve this answer
The code indenting looks out of whack. Can you fix that? – Shoan Aug 22 '15 at 1:13
@Shoan - Sorry been too long. I'm not actually working with this right now. This is a method I cut from a library I wrote, and I used it regularly when I was using it. So I know it worked at the time I posted it here. If it is an indent thing, then it shouldn't be too hard to figure it out (but I don't have time right now to build out an environment to fiddle with it, but you can ;) ). It could also be an issue with the version of the library maybe? In any case, it still is likely a good starting point for anyone wanting to do this programmatically with Boto. – BillR Aug 31 '15 at 18:23

Due to lack of a proper way of doing this online, I created a super simple script to handle it. Have a look if you're interested.

share|improve this answer
This is not really a good candidate for an "answer" submission. Might be useful as a comment when you have enough rep to post those. – Andrew B May 22 '14 at 16:31

From the EC2 console, click on Launch Instance and proceed to enter dummy info until you get to the security group section..

From here click on "Select an Existing Security Group", and below you will see all the security groups you have for that particular VPC. You should see a "Copy to New" link under "Actions", use this to copy all of your ACLs to a new SG.

Or I suppose you could use a script - this is faster IMO..

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.