This message was deleted.

yep, totally possible. you define the two groups, then use this resource to add the rules: https://www.pulumi.com/docs/reference/pkg/aws/ec2/securitygrouprule/

Awesome thanks