diff --git a/CHANGELOG.md b/CHANGELOG.md
index 5cf489ffa..13cab2653 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,8 @@
 
 FEATURES:
 
+* Amazon EBS builder can now optionally use a pre-made security group
+  instead of randomly generating one.
 * DigitalOcean API key and client IDs can now be passed in as
   environmental variables. See the documentatin for more details.
 * VirtualBox and VMware can now have `floppy_files` specified to attach
diff --git a/website/source/docs/builders/amazon-ebs.html.markdown b/website/source/docs/builders/amazon-ebs.html.markdown
index 2d5e24724..9de30fcb0 100644
--- a/website/source/docs/builders/amazon-ebs.html.markdown
+++ b/website/source/docs/builders/amazon-ebs.html.markdown
@@ -63,6 +63,12 @@ Required:
 
 Optional:
 
+* `security_group_id` (string) - The ID (_not_ the name) of the security
+  group to assign to the instance. By default this is not set and Packer
+  will automatically create a new temporary security group to allow SSH
+  access. Note that if this is specified, you must be sure the security
+  group allows access to the `ssh_port` given below.
+
 * `ssh_port` (int) - The port that SSH will be available on. This defaults
   to port 22.