SecurityGroup link from another media template inside VPC

Question

I have a VPC (created through cloudformation) that creates some common shared infrastructure for all the stacks created in this VPC, for example. ssh jumphost and the security group for ssh jumphost.

I have a separate cloud information template for creating Web + App + DB stacks inside an existing VPC.

How to allow incoming ssh 22 to my instances in my stack template from shared ssh jumphost defined in the first template?

According to the docs inside the VPC, I need to specify the SourceSecurityGroupId , which must either have the actual VPC ID, or use the Ref function to find the ID of the security group defined in this .

How can I refer to an existing SG inside the same VPC, but from a different template?

EDIT:

The same question is for outgoing through an NAT instance. A NAT instance is provided at the VPC level, but each stack needs its own security group to provide outbound access to only the NAT instance.

Answer 1

Update: this has changed since my initial answer. See also Vor's answer below, which suggests using custom resources and Lambda to allow multiple stack links.

Original answer

There is no support for referencing resources from another stack, so you cannot use Ref() . You can use SourceSecurityGroupId (as suggested by you) and pass it as parameter and / or you can use SourceSecurityGroupName . But Cloudformation cannot programmatically reference another stack.

I like to write Cloudformation templates using Python, boto and the troposphere library to get around problems like this in code.

Answer 2

An alternative to the previous answer would be to create a CustomResource . You can start the service on EC2, which is subscribed to the SQS queue. When the CFN reaches the CustomResource value, it will send an SNS notification to the topic you specify. Then your service will receive a notification, request a process and respond.

There is also a library that can help you with custom service setup https://github.com/aws/aws-cfn-resource-bridge