code: func findSecurityGroupForInstance(instance *ec2.Instance, taggedSecurityGroups map[string]*ec2.SecurityGroup) (*ec2.GroupIdentifier, error) {
  	instanceID := aws.StringValue(instance.InstanceId)
  
  	var tagged []*ec2.GroupIdentifier
  	var untagged []*ec2.GroupIdentifier
  	for _, group := range instance.SecurityGroups {
  		groupID := aws.StringValue(group.GroupId)
  		if groupID == "" {
  			glog.Warningf("Ignoring security group without id for instance %q: %v", instanceID, group)
  			continue
  		}
  		_, isTagged := taggedSecurityGroups[groupID]
  		if isTagged {
  			tagged = append(tagged, group)
  		} else {
  			untagged = append(untagged, group)
  		}
  	}
  
  	if len(tagged) > 0 {
  		// We create instances with one SG
  		// If users create multiple SGs, they must tag one of them as being k8s owned
  		if len(tagged) != 1 {
  			return nil, fmt.Errorf("Multiple tagged security groups found for instance %s; ensure only the k8s security group is tagged", instanceID)
  		}
  		return tagged[0], nil
  	}
  
  	if len(untagged) > 0 {
  		// For back-compat, we will allow a single untagged SG
  		if len(untagged) != 1 {
  			return nil, fmt.Errorf("Multiple untagged security groups found for instance %s; ensure the k8s security group is tagged", instanceID)
  		}
  		return untagged[0], nil
  	}
  
  	glog.Warningf("No security group found for instance %q", instanceID)
  	return nil, nil
  }
docs: // Returns the first security group for an instance, or nil
  // We only create instances with one security group, so we don't expect multiple security groups.
  // However, if there are multiple security groups, we will choose the one tagged with our cluster filter.
  // Otherwise we will return an error.