fix for security group creation during discovery

This is a bit of a hack. It turns out we don't know whether there is
an Ec2 cloud at the time we're setting up discovery. This is a problem
that actually needs to be thoughtfully solved, but for now I'm going
to ensure that there is an ec2 cloud and create the security groups
within that.