Wow... you can't chance a security group of an ec2 instance on amazon aws once it has been run -- at all?! #fail