# Adding a security group to running ec2 instance **URL:** \ **Category:** Ansible Project\ **Created:** [June 4, 2014, 2:29pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401 "2014-06-04T14:29:25Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Louis\_Garman](https://avatars.discourse-cdn.com/v4/letter/l/ec9cab/32.png) [@Louis\_Garman](https://forum.ansible.com/u/Louis_Garman)\ **Post date:** [June 4, 2014, 2:29pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/1 "2014-06-04T14:29:25Z")
Is there a way to update the properties of a running ec2 instance? Specifically, I’d like to add security groups to a running VPC instance. I’ve used the ec2 module to create an instance, but once it’s running, adding a security group to the ‘group’ parameter and re-running the playbook has no effect. The exceptions are the count\_tag and exact\_count parameters, which create/destroy instances accordingly. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [June 4, 2014, 2:41pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/2 "2014-06-04T14:41:46Z")
aws doesn’t allow you to change the security group association of a instance once created, you CAN change the rules of the existing security group. Ansible cannot give you something that aws itself doesn’t support.​ ---
**Author:** ![Brent\_Langston](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@Brent\_Langston](https://forum.ansible.com/u/Brent_Langston)\ **Post date:** [June 4, 2014, 3:08pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/3 "2014-06-04T15:08:09Z")
Whoa. Maybe I’m misunderstanding you but I add and remove security groups on instances while running all the time. It would be cool to do that via ansible. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [June 4, 2014, 3:24pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/4 "2014-06-04T15:24:54Z")
this might have changed, I have not even tried in a good while. This used to be a restriction, I stand corrected and happy to hear, it was a major pain. ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [June 4, 2014, 3:27pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/5 "2014-06-04T15:27:23Z")
just double checked aws documentation: “After you launch an instance in EC2-Classic, you can’t change its security groups. However, you can add rules to or remove rules from a security group, and those changes are automatically applied to all instances that are associated with the security group.” ​ will try this later to confirm, not sure what ‘classic’ means either ---
**Author:** ![Brian\_Coca1](https://avatars.discourse-cdn.com/v4/letter/b/278dde/32.png) [@Brian\_Coca1](https://forum.ansible.com/u/Brian_Coca1)\ **Post date:** [June 4, 2014, 3:28pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/6 "2014-06-04T15:28:32Z")
ah, VPC instances have different rules, ‘classic’ is non VPC from what I can see.​ ---
**Author:** ![Brent\_Langston](https://avatars.discourse-cdn.com/v4/letter/b/73ab20/32.png) [@Brent\_Langston](https://forum.ansible.com/u/Brent_Langston)\ **Post date:** [June 4, 2014, 4:07pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/7 "2014-06-04T16:07:16Z")
Yep. that must be the difference. I’m all VPC. ---
**Author:** ![Louis\_Garman](https://avatars.discourse-cdn.com/v4/letter/l/ec9cab/32.png) [@Louis\_Garman](https://forum.ansible.com/u/Louis_Garman)\ **Post date:** [June 4, 2014, 4:12pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/8 "2014-06-04T16:12:27Z")
Yes, you can update an instance’s list of security groups if that instance is in a VPC: [http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC\_SecurityGroups.html](http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_SecurityGroups.html) (see “Differences Between Security Groups for EC2-Classic and EC2-VPC”) ---
**Author:** ![Louis\_Garman](https://avatars.discourse-cdn.com/v4/letter/l/ec9cab/32.png) [@Louis\_Garman](https://forum.ansible.com/u/Louis_Garman)\ **Post date:** [June 4, 2014, 4:26pm UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/9 "2014-06-04T16:26:01Z")
I’ll create a pull request. As an aside, updating _any_ of the ec2 module parameters will not update the instance. Which is often in practice is undesirable or impossible, because most of the parameters would require a restart (think instance\_type, etc). However, ‘volumes’ is one such parameter that could be updatable (but isn’t, I tried). I worked around that by creating a ‘ec2\_vol’, and specifying the instance\_id in there. ---
**Author:** ![iain\_wright](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iain\_wright](https://forum.ansible.com/u/iain_wright)\ **Post date:** [June 19, 2014, 12:37am UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/10 "2014-06-19T00:37:07Z")
Hi Louis et. all, This just bit us (performing modifications of security groups/volumes of running instances using ec2 module in the context of a VPC) Did you ever end up modifying the module to support these mutations in a VPC based enviornment? We’d love to use them if so! Thank you, iain ---
**Author:** ![iain\_wright](https://avatars.discourse-cdn.com/v4/letter/i/5e9695/32.png) [@iain\_wright](https://forum.ansible.com/u/iain_wright)\ **Post date:** [June 19, 2014, 1:24am UTC](https://forum.ansible.com/t/adding-a-security-group-to-running-ec2-instance/15401/11 "2014-06-19T01:24:38Z")
Ah, i see this is possible in ec2\_vol, we are going to pursue that route. Hopefully we can get ec2 module modified to support security group mutations when in a VPC and will submit a pull request if we do! Thank you, iain