After you launch an instance in EC2-Classic, you can't change its security groups. However, you canadd rules to or remove rules from a security group, and those changes are automatically applied toall instances that are associated with the security group. Reference: http://docs.amazonwebservices.com/AWSEC2/latest/UserGuide/using-networksecurity.html