Comment 1 for bug 1006963

this is fixed now in trunk and in quantal.
the string 'security' can now be used to refer to the security mirror in the template in /etc/cloud/templates/sources.list.tmpl .

And, ubuntu's /etc/cloud/cloud.cfg contains:
system_info:
   package_mirrors:
     - arches: [i386, amd64]
       failsafe:
         primary: http://archive.ubuntu.com/ubuntu
         security: http://security.ubuntu.com/ubuntu