diff --git a/pkg/config/config.go b/pkg/config/config.go
index b30a5d1628f806..9c02165b07b03b 100644
--- a/pkg/config/config.go
+++ b/pkg/config/config.go
@@ -173,6 +173,8 @@ func init() {
 
 	// ECS
 	Datadog.SetDefault("ecs_agent_url", "") // Will be autodetected
+	Datadog.SetDefault("collect_ec2_tags", false)
+	Datadog.SetDefault("collect_security_groups", false)
 
 	// Cloud Foundry
 	Datadog.SetDefault("cloud_foundry", false)
diff --git a/pkg/legacy/converter.go b/pkg/legacy/converter.go
index edd6a0591aa5f2..f916a7ff65b8be 100644
--- a/pkg/legacy/converter.go
+++ b/pkg/legacy/converter.go
@@ -51,7 +51,13 @@ func FromAgentConfig(agentConfig Config) error {
 		config.Datadog.Set("default_integration_http_timeout", value)
 	}
 
-	// TODO: collect_ec2_tags
+	if enabled, err := isAffirmative(agentConfig["collect_ec2_tags"]); err == nil {
+		config.Datadog.Set("collect_ec2_tags", enabled)
+	}
+
+	if enabled, err := isAffirmative(agentConfig["collect_security_groups"]); err == nil {
+		config.Datadog.Set("collect_security_groups", enabled)
+	}
 
 	// config.Datadog has a default value for this, do nothing if the value is empty
 	if agentConfig["additional_checksd"] != "" {
diff --git a/pkg/legacy/importer.go b/pkg/legacy/importer.go
index fde448743d89e4..865a2865c77744 100644
--- a/pkg/legacy/importer.go
+++ b/pkg/legacy/importer.go
@@ -29,6 +29,7 @@ var (
 		"forwarder_timeout",
 		"default_integration_http_timeout",
 		"collect_ec2_tags",
+		"collect_security_groups",
 		"additional_checksd",
 		"exclude_process_args",
 		"histogram_aggregates",
diff --git a/pkg/legacy/tests/datadog.conf b/pkg/legacy/tests/datadog.conf
index f3d220c18da6b9..182984f80848de 100644
--- a/pkg/legacy/tests/datadog.conf
+++ b/pkg/legacy/tests/datadog.conf
@@ -48,9 +48,9 @@ default_integration_http_timeout: 7
 create_dd_check_tags: False
 
 # Collect AWS EC2 custom tags as agent tags (requires an IAM role associated with the instance)
-collect_ec2_tags: False
+collect_ec2_tags: True
 # Incorporate security-groups into tags collected from AWS EC2
-# collect_security_groups: False
+collect_security_groups: True
 
 # Enable Agent Developer Mode
 # Agent Developer Mode collects and sends more fine-grained metrics about agent and check performance
@@ -295,4 +295,4 @@ collect_instance_metadata: False
 [trace.ignore]
 # a blacklist of regular expressions can be provided to disable certain traces based on their resource name
 # all entries must be surrounded by double quotes and separated by comas
-# resource="GET|POST /healthcheck","GET /V1"
\ No newline at end of file
+# resource="GET|POST /healthcheck","GET /V1"
diff --git a/pkg/metadata/host/host.go b/pkg/metadata/host/host.go
index a8d789522f7c43..8aab56691418a4 100644
--- a/pkg/metadata/host/host.go
+++ b/pkg/metadata/host/host.go
@@ -76,15 +76,17 @@ func GetMeta() *Meta {
 
 func getHostTags() *tags {
 	hostTags := config.Datadog.GetStringSlice("tags")
-	var gceTags []string
 
-	ec2Tags, err := ec2.GetTags()
-	if err != nil {
-		log.Debugf("No EC2 host tags %v", err)
+	if config.Datadog.GetBool("collect_ec2_tags") {
+		ec2Tags, err := getEC2Tags()
+		if err != nil {
+			log.Debugf("No EC2 host tags %v", err)
+		} else {
+			hostTags = append(hostTags, ec2Tags...)
+		}
 	}
-	hostTags = append(hostTags, ec2Tags...)
 
-	gceTags, err = gce.GetTags()
+	gceTags, err := gce.GetTags()
 	if err != nil {
 		log.Debugf("No GCE host tags %v", err)
 	}
@@ -95,6 +97,24 @@ func getHostTags() *tags {
 	}
 }
 
+func getEC2Tags() ([]string, error) {
+	ec2Tags, err := ec2.GetTags()
+	if err != nil {
+		return ec2Tags, err
+	}
+
+	if !config.Datadog.GetBool("collect_security_groups") {
+		// remove the `security_group_name` tag if present
+		for i, s := range ec2Tags {
+			if strings.HasPrefix(s, "security_group_name:") {
+				ec2Tags = append(ec2Tags[:i], ec2Tags[i+1:]...)
+			}
+		}
+	}
+
+	return ec2Tags, nil
+}
+
 func getSystemStats() *systemStats {
 	var stats *systemStats
 	key := buildKey("systemStats")
diff --git a/releasenotes/notes/support-ec2-metadata-options-6287da5d6462fc44.yaml b/releasenotes/notes/support-ec2-metadata-options-6287da5d6462fc44.yaml
new file mode 100644
index 00000000000000..bf16ffb0b987e1
--- /dev/null
+++ b/releasenotes/notes/support-ec2-metadata-options-6287da5d6462fc44.yaml
@@ -0,0 +1,4 @@
+---
+features:
+  - |
+    Add support for collect_ec2_tags and collect_security_groups configuration options.