While it is true that you cannot add new ones or remove existing ones, you can modify an existing security group of a running instance: http://aws.amazon.com/articles/1145?_encoding=UTF8&jiveR....