diff --git a/aws/resource_aws_security_group.go b/aws/resource_aws_security_group.go
index <HASH>..<HASH> 100644
--- a/aws/resource_aws_security_group.go
+++ b/aws/resource_aws_security_group.go
@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"fmt"
 	"log"
+	"regexp"
 	"sort"
 	"strconv"
 	"strings"
@@ -47,7 +48,10 @@ func resourceAwsSecurityGroup() *schema.Resource {
 				Computed:      true,
 				ForceNew:      true,
 				ConflictsWith: []string{"name_prefix"},
-				ValidateFunc:  validation.StringLenBetween(0, 255),
+				ValidateFunc: validation.All(
+					validation.StringLenBetween(0, 255),
+					validation.StringDoesNotMatch(regexp.MustCompile(`^sg-`), "cannot begin with sg-"),
+				),
 			},
 
 			"name_prefix": {
Validate that security group names aren't prefixed with sg-

The [API docs](<URL>) have this to say:
> Constraints: Up to <I> characters in length. Cannot start with sg-.