I have created a new EC2 instance. It got assigned the default security group. I want to change that security group. How?


7 Answers 7


Unless the instance is in a VPC, security groups can only be chosen before you start your instance for the first time.

Only VPC instances can change security group. For information on VPC see here.

  • 4
    As Vitaly says: "After an instance is running, you can't change which security groups it belongs to." (cited from the reference documentation). You could take a snapshot / AMI from the instance and launch it with a different security group, though.
    – Axel Knauf
    Commented Feb 21, 2011 at 12:50
  • 15
    Thanks for the reference, Axel. Although I know you are correct, the wording in the documentation is rather ambiguous: "After an instance is running, you can't change which security groups it belongs to." This suggested to me that if you stopped the instance you could then change the security group. A better way to word this would have been "After an instance has run for the first time, you can't change which security groups it belongs to."
    – user35042
    Commented Feb 22, 2011 at 6:40
  • 3
    While you cannot change which security group is linked to the instance, you CAN edit the linked security group, and the changes take effect immediately, no need to restart the instance.
    – RomanSt
    Commented May 4, 2014 at 2:50
  • It's no longer true. You can.
    – Navern
    Commented Dec 11, 2018 at 12:04

Now you can change the security group of an EC2 instance from the web console itself.

Select an instance -> right click or click Actions -> Under Networking -> select Change Security Groups

enter image description here

  • 8
    This should be the accepted answer. You can change security groups of an instance
    – Shrey
    Commented Feb 2, 2017 at 7:32
  • 1
    @Shrey The question was asked in 2011 when the web interface wasn't available. The accepted answer was probably the best option then :) Commented Feb 2, 2017 at 8:39
  • 1
    As for 2022, It has changed to Actions -> Security -> Change security groups
    – Diogo Melo
    Commented Jun 20, 2022 at 23:59

For instances launched without a VPC, the Security Group can only be specified at first launch, and cannot be changed afterwards, not even if the instance is stopped first.

For instances launched into a VPC, the group can be changed. However, not all instance types are supported in the VPC - for example, "micro" is not supported as of December 2011.


According to the Amazon EC2 documentation, you can update the assigned security group.

After you launch an instance in EC2-Classic, you can't change its security groups. However, you can add rules to or remove rules from a security group, and those changes are automatically applied to all instances that are associated with the security group.


There is a way to accomplish this for an EBS-backed instance in a non-VPC environment, but it's a little painful:

  1. Shutdown the server you want to change.
  2. Right click the server and select Create Image to make an AMI from it.
  3. Once the AMI has been created, right click on the AMI and select Launch Instance.
  4. Choose the new security group as part of provisioning a "new" server.

This only works for EBS-backed instances that persist beyond a stop/start cycle.


I just changed the security group of an EC2 instance without even stopping it first. So maybe the policy has changed.

The instance in question was indeed inside a VPC. I didn't manually create that VPC, though. I think the default now is for a new instance to be inside a VPC.


Just stop the instance and right click on it:

  • If it's a vpc instance you will find the option to change the security groups under Networking

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .