diff --git a/senza/aws.py b/senza/aws.py
index 1284ba3..c7f0468 100644
--- a/senza/aws.py
+++ b/senza/aws.py
@@ -55,13 +55,12 @@ def is_status_complete(status: str):
 def get_security_group(region: str, sg_name: str):
     ec2 = boto3.resource('ec2', region)
     try:
-        sec_groups = list(ec2.security_groups.filter(
-            Filters=[{'Name': 'group-name', 'Values': [sg_name]}]
-        ))
-        if not sec_groups:
-            return None
-        # FIXME: What if we have 2 VPC, with a SG with the same name?!
-        return sec_groups[0]
+        # first try by tag name then by group-name (cannot be changed)
+        for _filter in [{'Name': 'tag:Name', 'Values': [sg_name]}, {'Name': 'group-name', 'Values': [sg_name]}]:
+            sec_groups = list(ec2.security_groups.filter(Filters=[_filter]))
+            if sec_groups:
+                # FIXME: What if we have 2 VPC, with a SG with the same name?!
+                return sec_groups[0]
     except ClientError as e:
         error_code = extract_client_error_code(e)
         if error_code == 'InvalidGroup.NotFound':

Lookup SecurityGroups by the tag "Name" rather than GroupName
Both AWS API and CloudFormation allow to refer to a security group by its name if the operation runs in EC2 Classic or the default VPC. Unfortunately it uses the `GroupName` attribute that is automatically generated by AWS if the SG is a part of CloudFormation stack.

It would be a good idea to extend Senza to lookup SG during the CF template generation phase and to use the _tag_ `Name` instead. The tag can be set by another ("system") Senza stack definition, thus allowing the cross-stack references.

Another option would be to support the new cross-stack references that are recently introduced by Amazon:  https://aws.amazon.com/blogs/aws/aws-cloudformation-update-yaml-cross-stack-references-simplified-substitution/
diff --git a/tests/test_aws.py b/tests/test_aws.py
index 4ca762a..8dd5b44 100644
--- a/tests/test_aws.py
+++ b/tests/test_aws.py
@@ -14,6 +14,21 @@ def test_get_security_group(monkeypatch):
     assert results == get_security_group('myregion', 'group_inexistant')
 
 
+def test_get_security_group_by_tag_name(monkeypatch):
+
+    def mock_filter(Filters):
+        if Filters[0]['Name'] == 'tag:Name' and Filters[0]['Values'] == ['my-sg']:
+            sg = MagicMock()
+            sg.id = 'sg-123'
+            return [sg]
+
+    ec2 = MagicMock()
+    ec2.security_groups.filter = mock_filter
+    monkeypatch.setattr('boto3.resource', MagicMock(return_value=ec2))
+
+    assert get_security_group('myregion', 'my-sg').id == 'sg-123'
+
+
 def test_resolve_security_groups(monkeypatch):
     ec2 = MagicMock()
     ec2.security_groups.filter = MagicMock(side_effect=[

pip install -e .
parse_log_pytest
requirements.txt
pytest pytest-cov mock
3.5
requirements.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
attrs==22.2.0
boto3==1.23.10
botocore==1.26.10
certifi==2021.5.30
charset-normalizer==2.0.12
click==8.0.4
clickclick==20.10.2
coverage==6.2
dnspython==1.15.0
dnspython3==1.15.0
idna==3.10
importlib-metadata==4.8.3
iniconfig==1.1.1
jmespath==0.10.0
mock==5.2.0
packaging==21.3
pluggy==1.0.0
py==1.11.0
pyparsing==3.1.4
pystache==0.6.4
pytest==7.0.1
pytest-cov==4.0.0
python-dateutil==2.9.0.post0
PyYAML==6.0.1
raven==6.10.0
requests==2.27.1
s3transfer==0.5.2
six==1.17.0
stups-cli-support==1.1.22
stups-pierone==1.1.56
-e git+https://github.com/zalando-stups/senza.git@56e263195218e3fe052e95221b2d9528c4343264#egg=stups_senza
stups-tokens==1.1.19
stups-zign==1.2
tomli==1.2.3
typing==3.7.4.3
typing_extensions==4.1.1
urllib3==1.26.20
zipp==3.6.0

name: senza
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - certifi=2021.5.30=py36h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.3=he6710b0_2
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=1.1.1w=h7f8727e_0
  - pip=21.2.2=py36h06a4308_0
  - python=3.6.13=h12debd9_1
  - readline=8.2=h5eee18b_0
  - setuptools=58.0.4=py36h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - wheel=0.37.1=pyhd3eb1b0_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - attrs==22.2.0
      - boto3==1.23.10
      - botocore==1.26.10
      - charset-normalizer==2.0.12
      - click==8.0.4
      - clickclick==20.10.2
      - coverage==6.2
      - dnspython==1.15.0
      - dnspython3==1.15.0
      - idna==3.10
      - importlib-metadata==4.8.3
      - iniconfig==1.1.1
      - jmespath==0.10.0
      - mock==5.2.0
      - packaging==21.3
      - pluggy==1.0.0
      - py==1.11.0
      - pyparsing==3.1.4
      - pystache==0.6.4
      - pytest==7.0.1
      - pytest-cov==4.0.0
      - python-dateutil==2.9.0.post0
      - pyyaml==6.0.1
      - raven==6.10.0
      - requests==2.27.1
      - s3transfer==0.5.2
      - six==1.17.0
      - stups-cli-support==1.1.22
      - stups-pierone==1.1.56
      - stups-tokens==1.1.19
      - stups-zign==1.2
      - tomli==1.2.3
      - typing==3.7.4.3
      - typing-extensions==4.1.1
      - urllib3==1.26.20
      - zipp==3.6.0
prefix: /opt/conda/envs/senza

tests/test_aws.py::test_get_security_group_by_tag_name
tests/test_aws.py::test_get_security_group tests/test_aws.py::test_resolve_security_groups tests/test_aws.py::test_create tests/test_aws.py::test_encrypt tests/test_aws.py::test_list_kms_keys tests/test_aws.py::test_get_vpc_attribute tests/test_aws.py::test_get_account_id tests/test_aws.py::test_get_account_alias tests/test_aws.py::test_resolve_referenced_resource tests/test_aws.py::test_resolve_referenced_resource_with_update_complete_status tests/test_aws.py::test_resolve_referenced_output_when_stack_is_in_update_complete_status tests/test_aws.py::test_parse_time tests/test_aws.py::test_required_capabilities tests/test_aws.py::test_resolve_topic_arn tests/test_aws.py::test_matches_any tests/test_aws.py::test_get_tag
senza/aws.py
senza/aws.py