Example for how to supply optional Security Groups to a LaunchConfig (or EC2 instance)

additional-sgs.template

{
  "AWSTemplateFormatVersion" : "2010-09-09",

  "Parameters": {

    "PrimarySG": {
      "Description": "Primary Security Group for the instance",
      "Type": "String",
      "Default": "sg-863ab0e0",
      "ConstraintDescription": "must be an EC2 security group id"
    },

    "AdditionalSGs": {
      "Description": "Additional security groups for the instance",
      "Type": "CommaDelimitedList",
      "Default": "sg-e23ab084,sg-bb27addd",
      "ConstraintDescription": "must be a list of EC2 security group ids"
    }

  },

  "Conditions" : {

    "MoreSGs": { "Fn::Not": [
        { "Fn::Equals": [ "",
            { "Fn::Join": [ "", { "Ref": "AdditionalSGs" } ] }
        ] }
    ] }

  },

  "Resources": {

    "InstanceLaunchConfig": {
      "Type": "AWS::AutoScaling::LaunchConfiguration",
      "Properties": {
        "InstanceType": "t2.nano",
        "KeyName": "SecretKey",
        "ImageId": "ami-deadbeef",
        "SecurityGroups": {
            "Fn::If": [
                "MoreSGs",
                { "Fn::Split": [ ",",
                    { "Fn::Join": [ ",", [
                        { "Ref": "PrimarySG" },
                        { "Fn::Join": [ ",", { "Ref": "AdditionalSGs" } ] }
                    ] ] }
                ] },
                { "Fn::Split": [ ",", 
                    { "Ref": "PrimarySG" }
                ] }
            ]
        }
      }
    }

  }
}