only run final secgroup rule if it knows the id