title: Add a parameterized list of security groups to another security group's ingress
body: <p>I'd like to create a CloudFormation template that creates a security group resource that allows ingress from a variable list of other security groups. The template would take a parameter of type <code>List&lt;AWS::EC2::SecurityGroup::Id&gt;</code>. I'll name this parameter <code>SourceSecurityGroupIds</code> for this example. Then, it would create a security group resource using something like:</p>
  
  <pre><code>{
      "LogServerSecurityGroup": {
          "Type": "AWS::EC2::SecurityGroup",
          "Properties": {
              "GroupDescription": "XYZ security group",
              "VpcId": "vpc-abcxyz",
              "SecurityGroupIngress": [
                  {
                      "IpProtocol": "tcp",
                      "FromPort": 1234,
                      "ToPort": 1234,
                      "SourceSecurityGroupId": { "Ref": "SourceSecurityGroupIds" }
                  }
              ]
          }
      }
  }
  </code></pre>
  
  <p>Of course, the <code>SourceSecurityGroupId</code> property of <code>SecurityGroupIngress</code> doesn't take a list. Is there a way to make this work?</p>
  
  <h1>Update - Feb 27, 2019</h1>
  
  <p>In retrospect, the correct way to do this is to create a <code>LogSourceSecurityGroup</code>, and allow ingress only from that security group. Then, add that security group to any EC2 instance, etc that should be able to communicate with the log server.</p>