In VPC groups must be specified by setting :security_group_ids rather than :groups

This is backwards compatible with non-VPC hosts so, for simplicity's sake, it probably makes sense to just do it this way.