Instance record is not inserted in db if the security group passed to the RunInstances API doesn't exists.

nova/compute/api.py

@@ -383,10 +383,6 @@ class API(base.Base):
         If you are changing this method, be sure to update both
         call paths.
         """
-        instance = dict(launch_index=num, **base_options)
-        instance = self.db.instance_create(context, instance)
-        instance_id = instance['id']
-
         elevated = context.elevated()
         if security_group is None:
             security_group = ['default']
@@ -400,6 +396,10 @@ class API(base.Base):
                     security_group_name)
             security_groups.append(group['id'])
 
+        instance = dict(launch_index=num, **base_options)
+        instance = self.db.instance_create(context, instance)
+        instance_id = instance['id']
+
         for security_group_id in security_groups:
             self.db.instance_add_security_group(elevated,
                                                 instance_id,

nova/tests/test_compute.py

@@ -161,6 +161,19 @@ class ComputeTestCase(test.TestCase):
             db.security_group_destroy(self.context, group['id'])
             db.instance_destroy(self.context, ref[0]['id'])
 
+    def test_create_instance_with_invalid_security_group_raises(self):
+        instance_type = instance_types.get_default_instance_type()
+
+        pre_build_len = len(db.instance_get_all(context.get_admin_context()))
+        self.assertRaises(exception.SecurityGroupNotFoundForProject,
+                          self.compute_api.create,
+                          self.context,
+                          instance_type=instance_type,
+                          image_href=None,
+                          security_group=['this_is_a_fake_sec_group'])
+        self.assertEqual(pre_build_len,
+                         len(db.instance_get_all(context.get_admin_context())))
+
     def test_create_instance_associates_config_drive(self):
         """Make sure create associates a config drive."""