As per examples, AWS CPI takes default_security_groups (plural)