even in VPC case, ec2_security_groups should not be empty