code: func (c *Cloud) addSecurityGroupIngress(securityGroupID string, addPermissions []*ec2.IpPermission) (bool, error) {
  	// We do not want to make changes to the Global defined SG
  	if securityGroupID == c.cfg.Global.ElbSecurityGroup {
  		return false, nil
  	}
  
  	group, err := c.findSecurityGroup(securityGroupID)
  	if err != nil {
  		klog.Warningf("Error retrieving security group: %q", err)
  		return false, err
  	}
  
  	if group == nil {
  		return false, fmt.Errorf("security group not found: %s", securityGroupID)
  	}
  
  	klog.V(2).Infof("Existing security group ingress: %s %v", securityGroupID, group.IpPermissions)
  
  	changes := []*ec2.IpPermission{}
  	for _, addPermission := range addPermissions {
  		hasUserID := false
  		for i := range addPermission.UserIdGroupPairs {
  			if addPermission.UserIdGroupPairs[i].UserId != nil {
  				hasUserID = true
  			}
  		}
  
  		found := false
  		for _, groupPermission := range group.IpPermissions {
  			if ipPermissionExists(addPermission, groupPermission, hasUserID) {
  				found = true
  				break
  			}
  		}
  
  		if !found {
  			changes = append(changes, addPermission)
  		}
  	}
  
  	if len(changes) == 0 {
  		return false, nil
  	}
  
  	klog.V(2).Infof("Adding security group ingress: %s %v", securityGroupID, changes)
  
  	request := &ec2.AuthorizeSecurityGroupIngressInput{}
  	request.GroupId = &securityGroupID
  	request.IpPermissions = changes
  	_, err = c.ec2.AuthorizeSecurityGroupIngress(request)
  	if err != nil {
  		klog.Warningf("Error authorizing security group ingress %q", err)
  		return false, fmt.Errorf("error authorizing security group ingress: %q", err)
  	}
  
  	return true, nil
  }
docs: // Makes sure the security group includes the specified permissions
  // Returns true if and only if changes were made
  // The security group must already exist