not all instances must have security groups attached (e.g. auto-launched NAT instances in VPC)