individual security groups according to instance/group role, closes #4