Currently, the ec2 counts all instances launched by the credentials it knows about against the instance cap. This makes sense in a braces and suspenders way, but can be a bit inconvenient. Once the fix for http://issues.jenkins-ci.org/browse/JENKINS-8617 lands, it will be possible to use the security group specified as a 'tag' for the instance and only count instances in the specified group against the tag.