Unable to update security group rule across regions - amazon-web-services

Question

Terraform Version: v0.11.8
I am trying to update the rule of security group which is in another region (Ireland) after deploying my current security group (Ohio).
Below is my code snippet:
variable "aws_account_id" {}
terraform {
backend "s3" {}
}
provider "aws" {
region = "us-east-2"
allowed_account_ids = ["${var.aws_account_id}"]
}
provider "aws" {
alias = "TestApp"
region = "eu-west-1"
}
data "aws_security_group" "test_sg" {
provider = "aws.TestApp"
name = "test-sg"
}
resource "aws_security_group" "test1_sg" {
name = "Test 1"
vpc_id = "VPC ID"
}
resource "aws_security_group_rule" "allow_test1_access_test_sg" {
provider = "aws.TestApp"
type = "ingress"
from_port = "80"
to_port = "80"
protocol = "tcp"
security_group_id = "${data.aws_security_group.test_sg.id}"
source_security_group_id = "${aws_security_group.test1_sg.id}"
}
I am getting circular dependency like below.
Case 1: Run above code, Getting error that test1_sg security group does not exist.
Case 2: Run above code without provider = "aws.TestApp" in aws_security_group_rule, Getting error that test_sg security group does not exist.
Case 3: Run above code without provider = "aws.TestApp" in data "aws_security_group" "test_sg" , Getting error that test_sg security group does not exist.
I am not sure this is 100% issue of inter-region communication but it seems like this is the case.
Note: The above error is coming while running terraform apply. Plan is showing correct change without any error.
Any help will be highly appreciated.
Thanks!

Answer 1

Ok so finally i found the answer.
As per Amazon documentation...
You cannot reference the security group of a peer VPC that's in a
different region. Instead, use the CIDR block of the peer VPC.
AWS Doc: Updating Your Security Groups to Reference Peer VPC Groups
I need to use cidr block instead of the security group while referencing in cross region.

Answer 2

As far as I can see with your case 1, your source security group should be "test1_sg". There is no security group with the name "test1_access_test2". Use this.
source_security_group_id = "${aws_security_group.test1_sg.id}"
Otherwise, go and check on your console whether that security group exists or not.