How should one handle inter-dependent AWS security groups? I have Security Group A which needs to allow traffic from Security Group B, and Security Group B which needs to allow traffic from Security Group A. Pulumi will error out if I reference group B in an ingress rule for group A before group B is defined. I thought maybe I could use a combination of SecurityGroup and SecurityGroupRule, but it looks like those should not be combined. Thoughts/ideas?

Define both groups, define all rules as `SecurityGroupRule`s.

I was really hoping that wasn't the answer. Thanks.

Yeah, it's one of those places where you realize that all this stuff is sitting on top of a not-always-great API.

TF bumped into the same problem in earlier days which was the reason to introduce separate SecurityGroupRule resources. With the Pulumi AWS provider based on the TF AWS provider, they are bound to the same setup.

Makes sense, thanks.