Security Groups referencing other Security Groups I'd like to use a single Security Group that holds all our internal network CIDRs. This one security group can be updated as CIDRs change. This group would not be applied directly to instances, but instead be referenced by other Security Groups with the port-specific rules required by that instance's use cases.

Is this possible? What should the ingress/egress rules be on the "Internal Networks" Security Group?