This message was deleted.

in case anyone finds this when searching, this is what i've done for now and it works

// Open egress traffic from our targets to your load balancer (for health checks).
const sg = new awsx.ec2.SecurityGroup('web-sg', {
  vpc,
  egress: [
    { protocol: '-1', fromPort: 0, toPort: 0, cidrBlocks: ['0.0.0.0/0'] },
  ],
});

export const alb = new awsx.lb.ApplicationLoadBalancer('web-services-lb', {
  vpc,
  securityGroups: [sg],
});