diff --git a/tempnotes.md b/tempnotes.md
index 57c4e51..da25ec4 100644
--- a/tempnotes.md
+++ b/tempnotes.md
@@ -147,6 +147,10 @@ Default ports:
 
 ## Work Commands
 
+### tags
+
+`--tags git=web-dev owner=home project=strapi-elb test=true deployment=cloudformation`
+
 ### deploy
 
 `aws --profile admin cloudformation deploy --template-file ./02-stack-vpc.yaml --stack-name strapi-vpc --tags git=web-dev owner=home project=strapi-elb test=true deployment=cloudformation`
diff --git a/todo.md b/todo.md
index 8c86186..be3687b 100644
--- a/todo.md
+++ b/todo.md
@@ -109,3 +109,11 @@ Deploy strapi with LB + scaling
 Enable HTTPS
 
 Codebuild
+
+Create the security group for the EC2 instances
+Add this security group to Outputs
+Reference it in RDS security group
+
+Check ssh? - Can ssh if you apply it to the EC2 SG you create.
+
+Multiple security groups get squashed to determine what is and isn't allowed: <https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-security-groups.html>.