EC2 Security Group: Only works when removed and readded

Hi,

I've been trying to deploy an EC2 instance into my VPC, of which I'm confident on the configurations (ingress and egress rules, route tables, etc.). When I deploy the EC2 instance (tested with console, terraform, and cloud formation) with my security group I am unable to access the instance via the publicly assigned IP address. I have run the AWS Network Access Analyzer and Reachability Analyzer and nothing is showing as unreachable or incorrect.

After much trial and error the only solution that I was able to find was to:

1. remove my security group (sg1)
2. attach another (sg2)
3. save
4. remove sg2
5. attach sg1 (my desired security group)
6. save

After this the networking rules behave as expected.

• Have I missed something here?
• As I'm primarily using IaC does this have an impact e.g. other resources automatically being created such as Network Interfaces?
• I have also left some instances running to see if there was some propergation aspect however this doesn't seem to be the case.

I'm a little lost in terms of how I'd deploy the instances without having to manually correct the SG each time!

Below are various deployments I've tested, with XYZ replacing the actual sensitive data.

Terraform code (SG and EC2 instance):

...
### public
resource "aws_security_group" "sg_public" {
  name        = "sg_public"
  description = "Allow ingress from internal IP for HTTP, HTTPS, SSH. Allow egress HTTP, HTTPS for external api calls"
  vpc_id      = local.id_vpc

  tags = {
    Name = "sg_public"
  }

}
...
# also tested with aws_security_group_rule
resource "aws_vpc_security_group_egress_rule" "sg_public_rule_egress_allow_HTTP" {
  security_group_id = aws_security_group.sg_public.id
  cidr_ipv4         = "XYZ/0"
  ip_protocol       = "tcp"
  from_port         = 80
  to_port           = 80
}
...
resource "aws_instance" "ec2_small_test" {

  ami                         = "ami-0f71013b2c8bd2c29" # Amazon Linux 2023 AMI
  instance_type               = "t2.micro"
  vpc_security_group_ids      = [aws_security_group.sg_public.id]
  subnet_id                   = local.id_subnet
  associate_public_ip_address = true
  user_data                   = file("webapp.sh") # simple "hello world"

}
...

CF template that I tested deploying the SG with:

Description: CloudFormation template for an SG

Parameters:
  myVPC:
    Type: String
    Default: vpc-XYZ
    Description: vpc id

Resources:
  InstanceSecurityGroup:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupName: TestFromCF
      GroupDescription: Allow http to client host
      VpcId: !Ref myVPC
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: XYZ/32
      SecurityGroupEgress:
        - IpProtocol: tcp
          FromPort: 80
          ToPort: 80
          CidrIp: 0.0.0.0/0

CF template that I tested to launch the instance:

Description: CloudFormation template for an EC2 instance referencing an existing
  security group.

Parameters:
  SubnetId:
    Type: String
    Default: subnet-XYZ
    Description: The ID of the subnet to launch the instance in.
  SecurityGroupId:
    Type: String
    Default: sg-XYZ
    Description: The ID of the existing security group.

Resources:
  EC2Instance:
    Type: AWS::EC2::Instance
    Properties:
      InstanceType: t2.micro
      ImageId: ami-0f71013b2c8bd2c29
      SubnetId: !Ref SubnetId
      SecurityGroupIds:
        - !Ref SecurityGroupId
      UserData: !Base64 |
        #!/bin/bash
        # Contents of webapp.sh
        echo "Hello, World!" > /var/www/html/index.html
        yum update -y
        yum install -y httpd
        systemctl start httpd
        systemctl enable httpd
      Tags:
        - Key: Name
          Value: hello_world_cf

Outputs:
  InstanceId:
    Description: The ID of the created EC2 instance.
    Value: !Ref EC2Instance
  InstancePublicIp:
    Description: The public IP address of the EC2 instance.
    Value: !GetAtt EC2Instance.PublicIp