answer my own question, this seem to work
vpcSgId := cluster.EksCluster.ApplyT(func(eksCluster *awseks.Cluster) pulumi.StringArrayOutput {
return eksCluster.VpcConfig.ClusterSecurityGroupId().ApplyT(func(sgId *string) []string {
return []string{*sgId}
}).(pulumi.StringArrayOutput)
})