I have run out of security groups while using Juju with HPCloud.
Do I need security group per instance? I have a limited quota of security groups.
One per machine/instance.
There are issues with doing this though. Juju de-couples the machine creation from the purposing of the machine. One can remove a service from a machine, and add another to any machine right now.
Bug #833064 suggests doing the firewall inside the machine using iptables. I think that may be a more flexible approach.
Bug #1027641 assigning a unique security group to each machine uses up security group quotas in HPCloud (openstack)