opscode/knife-ec2 — pull request #48 by jliuhtonen (2012-05-30 18:43:23+00:00)
Title: Fix for setting security groups in VPC mode: Option for using group ids instead of names 

Fog works in a way that when a subnet id is defined when a server is created, it only acceps a subnet id or a security group name. If subnet id is defined, the security group option is deleted. (See lib/fog/aws/models/compute/server.rb, line 140 in Fog 1.3.1)

However, if :security_group_ids option is defined, everything should work as expected. See [Fog issue 713](https://github.com/fog/fog/issues/713). From the discussion in the issue it seems that the root cause is that AWS API does not allow specifying security group name with a subnet.

Of course, using the -g option is also useful when subnet is not used, but one wants to specify security groups using ids for some other reason.