How can I add an additional Network Security Group with configuration in AWS Elastic Beanstalk?

I have the problem that I need to add the rds security group on every creation of an elastic beanstalk environment manually. Creating the new env, elastic beanstalk always creates a new default security group which I don't want to overwrite though.

2 Answers 2


If you create a new elastic beanstalk from the web console then it looks like you can set a single security group in your VPC configuration step. That is only if you use a VPC.

After the Elastic Beanstalk is created you can add security groups by editing the configuration under the "Instances" section.

Otherwise your option is to use the API or the command line (AWS CLI) to launch your elastic beanstalk. I've been frustrated with the web console because it doesn't allow you to set all elastic beanstalk options that are available, especially on start up.

I've just been using the command line to launch my elastic beanstalk environments. If you want to see what options are set for your existing environment you can use the describe-configuration-settings command. Then you can save the options, modify them, and use them when creating an environment. See the AWS doc on setting configuration options.

The example AWS gives is

aws elasticbeanstalk create-environment --application-name my-app --environment-name my-env --version-label v1 --template-name savedconfig --option-settings file://healthcheckurl.json

where the content of healthcheckurl.json is an array of the JSON-formatted options.


The easiest to add an existing security group to EB EC2 instances is to use the simple configuration described in https://github.com/awsdocs/elastic-beanstalk-samples/blob/master/configuration-files/aws-provided/security-configuration/securitygroup-addexisting.config

For example:

$ cat .ebextensions/securitygroup-addexisting.config
  - namespace: aws:autoscaling:launchconfiguration
    option_name: SecurityGroups
    value: rds-launch-wizard-1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.