diff --git a/awsapi/src/com/cloud/bridge/service/core/ec2/EC2GroupFilterSet.java b/awsapi/src/com/cloud/bridge/service/core/ec2/EC2GroupFilterSet.java
index 29ded60bec4..19a161dd22c 100644
--- a/awsapi/src/com/cloud/bridge/service/core/ec2/EC2GroupFilterSet.java
+++ b/awsapi/src/com/cloud/bridge/service/core/ec2/EC2GroupFilterSet.java
@@ -93,8 +93,10 @@ public class EC2GroupFilterSet {
                     }
                 }
             }
-            if (matched && ipPermissionFilterMatched(group, ipPermissionFilterSet))
-                resultList.addGroup( group );
+            if (matched) {
+                if (ipPermissionFilterSet.isEmpty() || ipPermissionFilterMatched(group, ipPermissionFilterSet))
+                    resultList.addGroup( group );
+            }
         }
         return resultList;
     }