Why do the docs https://pulumi.io/quickstart/cloudfx/index.html#configuration say:

externalSecurityGroups: (Optional) Provide securityGroup ids for the VPC as a comma-seperated string. Required if using an existing VPC.

I don't understand why

externalSecurityGroups

are required. My security groups are already associated with a VPC.