Be able to specify the security group(s) for load balancer(s)

[craigjbass]

Being able to specify the security group for a load balancer would give us the level of control we need. Something akin to load balanced services

http:
  private:
    security_groups:
      groups: [sg_xyz890, sg_abc123]
      deny_default: true

Originally posted by @CorinWilkins in https://github.com/aws/copilot-cli/issues/3934#issuecomment-1224800583

[craigjbass]

For context, we want all of our services not to be allowed to egress traffic to the public internet.

Right now, that means removing the default environment-wide security group, but this also means that services cannot talk to the internal application load balancer. We ideally want to be able to give specific access to the internal ALB, via a special security group.

[huanjani]

Hi! Could you clarify the context a bit-- do you have an environment with both a public ALB and an internal ALB? Are you importing a VPC or using a Copilot-generated one? Are your workloads in private or public subnets? Thanks!

[craigjbass]

We have both public and internal ALBs, and are importing our VPC.

We have workloads in both the public and private subnets.