What are ingress security_groups in Terraform for AWS

Question

I need to configure an EC2 instance with two security groups, one that already exists (sg1), and a new one that I am defining in terraform (sg2).

Reading Terraform's docs about aws_security_group resources, it mentions an optional field security_groups - (Optional) List of security group Group Names if using EC2-Classic, or Group IDs if using a VPC.

What does this actually mean? Does this leverage the ingress rules of sg1 and apply them to sg2? Does this mean I can pass in the security group id of sg1 to this field in my definition of sg2 to allow the same ingress as the sg1 or is this something completely different?

Also, if this is the case, because they have the same egress rules does this then mean that rather than passing both security_group_ids to my ec2 instance terraform, I could just pass sg1 id to sg2 ingress block in sg2's TF to achieve the same outcome?

Answer 1

Security group rules can reference CIDR blocks, prefix list IDs (for VPC endpoints) or other security groups.

This allows you to say that everything that has a security group of foo is allowed to communicate with everything with a security group of bar.

The bit specifically about whether it can be IDs (of the form sg-123456) or the names is down to a quirk in the AWS APIs and support for the long deprecated EC2 classic accounts. In general you want to use the IDs to reference security groups.