maybe `--extra-security-groups`?