
We need to find the ID for a named security group, or create a new one. We do this by listing the security groups, and then doing a create if we cannot find one. This is a race though; against another thread if the AWS API were consistent, but generally because the AWS API is actually eventually consistent. We wrap it in a retry loop.