title: Add an unknown-sized list of security groups to an EC2 instance
body: <p>We have a CloudFormation template that creates an EC2 instance and a security group (among many other resources), but we need to be able to add some additional pre-existing security groups to that same EC2 instance.</p>
  
  <p>The issue we have is that the number of pre-existing security groups won't always be the same, and we want to have a single template that will handle all cases.</p>
  
  <p>Currently, we have an input parameter that looks like this:</p>
  
  <pre><code>"WebTierSgAdditional": {
    "Type": "String",
    "Default": "",
    "Description": ""
  }
  </code></pre>
  
  <p>We pass into this parameter a comma-delimited string of pre-existing security groups, such as <code>'sg-abc123,sg-abc456'</code>.</p>
  
  <p>The SecurityGroup tag of the EC2 instance look like this:</p>
  
  <pre><code>"SecurityGroups": [
    {
      "Ref": "WebSg"
    },
    {
      "Ref": "WebTierSgAdditional"
    }
  ]
  </code></pre>
  
  <p>With this code, when the instance gets created, we get this error in the AWS console:</p>
  
  <blockquote>
    <p>Must use either use group-id or group-name for all the security groups, not both at the same time</p>
  </blockquote>
  
  <p>The 'WebSg' ref above is one of the security groups being created elsewhere in the template. This same error appears if we pass in a list of group names rather than a list of group Id's through the input parameter.</p>
  
  <p>When we change the "Type" field of the input parameter to be 'CommaDelimitedList', we get an error saying:</p>
  
  <blockquote>
    <p>Value of property SecurityGroups must be of type List of String</p>
  </blockquote>
  
  <p>It obviously can't join a list with a string to make it a new list.</p>
  
  <p>When the parameter only contains a single sg id, everything gets created successfully, however, we need to have the capability to add more than just one sg id.</p>
  
  <p>We have tried many different combinations of using <code>Fn::Join</code> within the SecurityGroups tag, but nothing seems to work.  What we really need is some sort of 'Explode' function to extract the individual id's from the parameter string.</p>
  
  <p>Does anyone know of a nice way to get this to work? </p>