Grr, conn.get_only_instances() doesn’t include security group info.  Need to use conn.get_all_reservations() instead.  GUI-74