fix(CF template): default security group