previously this was wrong -- correctly configure security group. configure ingress rules rather than try to add preexisting groups to layer