class AwsEc2Instance

def security_groups

is to use dumb things, like arrays of strings - use security_group_ids instead.
Don't document this - it's a bit hard to use. Our current doctrine 
def security_groups
  catch_aws_errors do
    @security_groups ||= instance.security_groups.map { |sg|
      { id: sg.group_id, name: sg.group_name }
    }
  end
end