title: How correctly externalize SecurityGroupEgress and SecurityGroupIngress in CloudFormation
body: <p>With the below CloudFormation template I'm able to SSH into the EC2 instance.</p>
  
  <pre><code>PublicSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
          GroupName: PublicSecurityGroup
          GroupDescription: Public Security Group
          VpcId:
              Ref: Vpc
          SecurityGroupEgress:
              - IpProtocol: "-1"
                  FromPort: 0
                  ToPort: 65535
                  CidrIp: 0.0.0.0/0
          SecurityGroupIngress:
              - IpProtocol: tcp
                  FromPort: 22
                  ToPort: 22
                  CidrIp: 0.0.0.0/0
  PublicEc2Instance:
      Type: AWS::EC2::Instance
      Properties:
          ImageId:
              Ref: ImageId
          InstanceType:
              Ref: InstanceType
          KeyName:
              Ref: KeyName
          SecurityGroupIds:
              - Fn::GetAtt:
                      - PublicSecurityGroup
                      - GroupId
          SubnetId:
              Ref: PublicSubnet
          Tags:
              - Key: Name
                  Value: PublicEc2Instance
  </code></pre>
  
  <p>When I change the <code>SecurityGroup</code> definition to the below structure</p>
  
  <pre><code>PublicSecurityGroup:
      Type: AWS::EC2::SecurityGroup
      Properties:
          GroupName: PublicSecurityGroup
          GroupDescription: Public Security Group
          VpcId:
              Ref: Vpc
  PublicOutboundRule1:
      Type: AWS::EC2::SecurityGroupEgress
      Properties:
          GroupId: !Ref PublicSecurityGroup
          SourceSecurityGroupId: !Ref PublicSecurityGroup
          IpProtocol: "-1"
          FromPort: 0
          ToPort: 65535
  PublicInboundRule1:
      Type: AWS::EC2::SecurityGroupIngress
      Properties:
          GroupId: !Ref PublicSecurityGroup
          SourceSecurityGroupId: !Ref PublicSecurityGroup
          IpProtocol: tcp
          FromPort: 22
          ToPort: 22
  </code></pre>
  
  <p>I'm not able to SSH in the EC2 instance any more.</p>
  
  <p>Why does externalization of <code>SecurityGroupEgress</code> and <code>SecurityGroupIngress</code> blocks the SSH access to the EC2?</p>
  
  <p>Thank you!</p>