Applying security groups to instances