You can change the security only if instance is launched within VPC. If instance is launched under EC2 classic then, there is no way to change the security group.
However, Accounts created after 2013-12-04, supports only VPC and all instances will be launched in default VPC, if user has not created any VPC. So concept of EC2-classic has vanished on account created after 2013-12-04.