diff --git a/server/src/com/cloud/network/security/SecurityGroupManagerImpl.java b/server/src/com/cloud/network/security/SecurityGroupManagerImpl.java
index b4c67b8d74d..a666ecdffc1 100755
--- a/server/src/com/cloud/network/security/SecurityGroupManagerImpl.java
+++ b/server/src/com/cloud/network/security/SecurityGroupManagerImpl.java
@@ -612,7 +612,7 @@ public class SecurityGroupManagerImpl extends ManagerBase implements SecurityGro
         }
 
         // Verify permissions
-        _accountMgr.checkAccess(caller, null, securityGroup);
+        _accountMgr.checkAccess(caller, AccessType.OperateEntry, securityGroup);
         Long domainId = owner.getDomainId();
 
         if (protocol == null) {
@@ -1120,7 +1120,7 @@ public class SecurityGroupManagerImpl extends ManagerBase implements SecurityGro
         }
 
         // check permissions
-        _accountMgr.checkAccess(caller, null, group);
+        _accountMgr.checkAccess(caller, AccessType.OperateEntry, group);
 
         return Transaction.execute(new TransactionCallbackWithException<Boolean, ResourceInUseException>() {
             @Override
diff --git a/server/src/com/cloud/user/AccountManagerImpl.java b/server/src/com/cloud/user/AccountManagerImpl.java
index b5fdc3a9163..301dde4fe63 100755
--- a/server/src/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/com/cloud/user/AccountManagerImpl.java
@@ -102,6 +102,7 @@ import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.dao.RemoteAccessVpnDao;
 import com.cloud.network.dao.RemoteAccessVpnVO;
 import com.cloud.network.dao.VpnUserDao;
+import com.cloud.network.security.SecurityGroup;
 import com.cloud.network.security.SecurityGroupManager;
 import com.cloud.network.security.dao.SecurityGroupDao;
 import com.cloud.network.vpc.Vpc;
@@ -497,7 +498,8 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
 
             for (ControlledEntity entity : entities) {
                 if (entity instanceof VirtualMachineTemplate || entity instanceof Network
-                        || entity instanceof AffinityGroup) {
+                        || entity instanceof AffinityGroup || entity instanceof SecurityGroup) {
+                    // Go through IAM (SecurityCheckers)
                     for (SecurityChecker checker : _securityCheckers) {
                         if (checker.checkAccess(caller, accessType, apiName, entity)) {
                             if (s_logger.isDebugEnabled()) {
@@ -540,6 +542,7 @@ public class AccountManagerImpl extends ManagerBase implements AccountManager, M
 
             }
         } else {
+            // Go through IAM (SecurityCheckers)
             for (SecurityChecker checker : _securityCheckers) {
                 if (checker.checkAccess(caller, accessType, apiName, entities)) {
                     if (s_logger.isDebugEnabled()) {