AWS Webapp tutorial: how to choose source in database security group?
A couple of things:


The tutorial assumes that you have already created an EC2 Security Group named WebServerSG, as shown in the previous step of the tutorial.
As of this writing, the auto-complete logic for the field in question keys off of the security group's Group ID rather than the Group Name. The tutorial incorrectly suggests the opposite. You can verify this by typing sg- (all Group IDs begin with sg-) and seeing the drop-down show all of your existing security groups.


Here's how it looks when I try it:



Security Groups are an abstraction that define inbound and outbound traffic rules that you can apply to instances. 

The purpose of this exercise is to allow inbound traffic associated with MySQL (we can tell this because the inbound port in the listed rule is 3306 -- commonly associated with MySQL) from your web server(s) to your database server(s). 

As demonstrated in the tutorial, you can reference other security groups in the rule definitions to build complex (or in this case, common -- web application servers regularly communicate with database servers) access patterns.