Do not assign security groups if disabled
Fix a bug that state_timeout is not used by stemcell_creator