use security group IDs, not names