our current vpc instances have only one security group. for ones that more than one it isn't ideal. I think it makes sense to switch to tags eventually.