A security group functions as a virtual firewall for your instance to control inbound and outbound traffic. To launch an instance in a VPC, it can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. As a result, each instance in a subnet in your VPC can be assigned to a different set of security groups.
If want to launch an instance using the Amazon EC2 API or a command line tool and no need to specify a security group, the instance is automatically assigned to the default security group for the VPC.
If want to launch an instance using the Amazon EC2 console, we have an option to create a new security group for the instance.
