document the VPC requirement to use security_group_ids instead of groups