assign overall app security group to new instances