This will fail if a launch config has no security groups.  Or is it safe to assume that a launch config will *always* have at least one security group?