Yes it is allowed to change setting in a group which is attached to a running instance of EC2.
Imagine in comissioning you allowed only 80 and 22 port to an instance , later you decided to open 443 also . You dont have to reboot/reinstall EC2 instance neither need to restart any service on Instance .
What you do is to use Amazon Mgt panel , go to that security group and add one more rule.. simple..
This will effect on runtime and instantanously on the running instance.