security groups are stateless