title: How to change RDS Security Group using boto3?
body: <p>I am restoring <em>(=creating a new instance)</em> an RDS MySQL Snapshot using <a href="http://boto3.readthedocs.io/en/latest/reference/services/rds.html#RDS.Client.restore_db_instance_from_db_snapshot" rel="nofollow noreferrer">boto3</a>. Unfortunately the Security Group does not get copied over instead it gets assigned the <em>default</em> Security Group which is has no limitations on incoming traffic.</p>
  
  <p>Looking at the source RDS instance I can see the correct Security Group (sg-a247eec5) attached to the RDS instance. This Security Group is visible under <em>EC2 - Security Groups</em> <strong>and</strong> <em>VPC - Security Groups</em> but not under <em>RDS - Security Groups</em>.</p>
  
  <p>I am using <a href="http://boto3.readthedocs.io/en/latest/reference/services/rds.html#RDS.Client.restore_db_instance_from_db_snapshot" rel="nofollow noreferrer">restore_db_instance_from_db_snapshot</a> but I can't see where I would attach that Security Group to the new instance.</p>
  
  <p><em>I can easily attach the correct Security Group by using the AWS UI (modifying my RDS Instance).</em></p>
  
  <p>There is <a href="http://boto3.readthedocs.io/en/latest/reference/services/ec2.html#EC2.Client.modify_instance_attribute" rel="nofollow noreferrer">modify_instance_attribute</a> on the EC2 client which can change Security Groups, but it requires an <strong>InstanceId</strong> which I don't get from my RDS instance. The only thing I can find is <strong>DBInstanceIdentifier</strong>.</p>
  
  <p><em>Trying to set the correct IAM permissions confuses me too. I have an RDS ARN: arn:aws:rds:ap-southeast-2:&lt;account_id>:db:&lt;db_instance_name> but ModifyInstanceAttribute is listed under Amazon EC2. Selecting both in the policy editor gives me an error saying the ARN is invalid (which makes sense).</em></p>