aws: Making security group ingress rules optional