anchor.diff:  * **access\_key\_id** [String, optional]: Accesss Key ID. Example: `AKI...`.
   * **secret\_access\_key** [String, optional]: Secret Access Key. Example: `0kwh...`.
   * **default\_key\_name** [String, required]: Name of the [Key Pair](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html) that will be applied to all created VMs. Example: `bosh`
  -* **default\_security\_groups** [Array, required]: Name of the [Security Group](http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.html) that will be applied to all created VMs. Consistently use either security group names or IDs. Example: `[bosh]`
  +* **default\_security\_groups** [Array, required]: See description under [networks](#networks).
   * **default\_iam\_instance\_profile** [String, optional]: Name of the [IAM instance profile](aws-iam-instance-profiles.html) that will be applied to all created VMs. Example: `director`.
   * **region** [String, required]: AWS region name. Example: `us-east-1`
   * **max_retries** [Integer, optional]: The maximum number of times AWS service errors (500) and throttling errors (`AWS::EC2::Errors::RequestLimitExceeded`) should be retried. There is an exponential backoff in between retries, so the more retries the longer it can take to fail. Defaults to 2.
  
positive.code: Schema for `cloud_properties` section used by dynamic network or manual network subnet:
  
  * **subnet** [String, required]: Subnet ID in which the instance will be created. Example: `subnet-9be6c3f7`.
  * **security_groups** [Array, optional]: Array of security groups to apply to all VMs placed on this network. Defaults to security groups specified by `default_security_groups` in the global CPI settings unless security groups are specified on a resource pool for a VM. Use either security group names or IDs, but be consistent. Security groups can be specified either on a resource pool or on a network.
  
  Example of manual network:
  
  
negative.code:     gateway: 10.10.0.1
      cloud_properties:
        subnet: subnet-9be6c3f7
        security_groups: [bosh]
  ```
  
  Example of dynamic network:
  