Cross account security group reference in Cloudformation

Question

Similar to this question: How do I add a cloudformation security group ingress rule that refers to another security group?

Is it possible to reference a security group that lies within another AWS Account?

Ideally I'd like to take a string input parameter like this: {account-id}/{security-group-id}

This doesn't work, but not sure why not..

"SecurityGroupEgress": [
            {
                "Description": "test referencing cross account sg",
                "DestinationSecurityGroupId": "1234455677/sg-124455",
                "IpProtocol": "icmp",
                "FromPort": "-1",
                "ToPort": "-1"
            }
        ],

And then reference that within the Template ingress/egress rules.

Answer 1

You can use this syntax (yaml) to be able to reference a security group from another AWS account:

LoadBalancerSecurityGroup
Type: 'AWS::EC2::SecurityGroup'
Properties:
  GroupDescription: 'Load Balancer SG'
  VpcId: !Ref VpcId
  SecurityGroupIngress:
  - IpProtocol: tcp
    FromPort: 443
    ToPort: 443
    SourceSecurityGroupOwnerId: '01234567890'
    SourceSecurityGroupId: 'sg-0123456789exampleid'

It's an ingress example, for egress, you usually do it the other way around, allowing the access on the other sg (modifying it's ingress).