1) added api-request limits checks
2) found out that script doesn't associate security groups with instances in our production environment
3) started writing docs