change security_group_id variable for security_group_ids as its a list
add a failure test for when user specifies ex_security_group_ids, but not ex_subnet