I want to change the security group on running ec2 instance which is not included in VPC. I read that this is possible only if my instance is running in VPC.

I tried to create a VPC and include my running instance in the active VPC by creating new network interfaces, and this is not possible as well.

Do you have any ideas how can I add/remove security groups on running ec2 instances?


After you launch an instance in EC2-Classic, you can't change its security groups. The same does not apply to VPC (Amazon EC2 Security Groups).

You could try creating AMI from current instance and then launch new instance with appropriate security groups.

  • yes, but downtime is not allowed, thanks anyway Sep 25 '14 at 11:39
  • 1
    The restriction on changing an instance's security groups only applies to EC2-Classic, not VPC, per the link you cited. Sep 25 '14 at 22:07

If downtime is not allowed, you could clone your server instance by making an image of it, then relaunching the image with the correct security group.

You could then create an ElasticLoadBalancer, place both the original and the clone behind the ELB, switch DNS (with very low TTL) from the priginal server to the ELB endpoint and the wait until the load is distributed across both.

You would then drop your original server out of the ELB, using connection draining, and reverse your DNS change so that it now pointed to the ip address of the new server.

You can then stop/terminate your old server, leaving you with the new one in the correct Security Group.

Of course, this solution won't work with a server running a writable database, but if you've got a writable DB on a single server instance in EC2 Classic, you've got other problems.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.