I sent a pull request for modifying security groups at runtime, and looks like I might have to code up Network ACL support.