I just put in the minimal set of bits - personally I never use the default security group and always create service specific ones in the VPC