its really odd that this would end up with a load balancer security group that is empty:

const alb = new awsx.lb.ApplicationLoadBalancer(`lb-unified-${packageInfo.packageName}`, {
        internal: false,
        subnetIds: vpc.publicSubnets.then(subnets => subnets.map(s => s.id)),
        defaultTargetGroup: {
            port: packageInfo.containerPort,
            protocol: 'HTTP',
            healthCheck: {
                path: '/',
                healthyThreshold: 2,
                unhealthyThreshold: 5,
                interval: 15,
            },
        },
        listeners: [{
            port: 443,
            protocol: 'HTTPS',
            sslPolicy: 'ELBSecurityPolicy-2016-08',
            certificateArn: packageInfo.primarySslCertArn,
        }],
        defaultSecurityGroup: {
            args: {
                ingress: [{
                    protocol: 'tcp',
                    fromPort: 443,
                    toPort: 443,
                    description: `SSL ingres for ALB`
                }]
            }
        }
    });

it isn't until I connect it to fargate service then it removes the ingress rule