How to access existing security group by tag using aws cdk?

Hi,

To be transparent, I did not try this on your specific use case: lambda + sec group. But, I usually use CDK Construct.fromXXX() to achieve what you want to achieve here.

The section "How can I reference existing resources?" in this article https://garbe.io/blog/2019/09/20/hey-cdk-how-to-use-existing-resources/ explains it well with all possible options for "fromXXX()" with their differences.

It seems quite possible , see https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ec2.SecurityGroup.html

If you have an existing security group you want to use in your CDK application, you would import it like this:

const securityGroup = ec2.SecurityGroup.fromSecurityGroupId(this, 'SG', 'sg-12345', {
  mutable: false
});

Best,

Didier