This will fail if there are no security groups for the instance.  Can we always assume that an instance has at least one security group?