That sounds good.  But I'm not sure if I would use : 

```ruby
SecurityGroupEgress( [ <array of EC2SecurityGroupRoles> ])
```

Not for inline declaration at least.  Maybe that could be useful in a more advanced VPC setup.  Like having a yaml file that contains the rules and just pass the generated array to define the resources. 

The last exemple would be nice, but I'm not sure how hard it would be to implement.  In the mean time can easily reproduce the behavior with a regular loop :

```ruby
[ "1.2.3.0/24", "4.5.6.0/24" ].each do |x|
    SecurityGroupEgress {
       CidrIP x
       FromPort 80
       ToPort 80
    }
end
```` 

But I admit the syntax of your proposition is better.


Right now I'm happy the single EC2SecurityGroupRole that get appended for a single SecurityGroupEgress declaration.   I added some basic functions that drastically reduce the amount of verbosity for the declaration of a security group. (and also use the same terms I am used to on AWS dashboard)

```ruby
def InboundRule(protocol, fromPort, toPort, cidr)
    SecurityGroupIngress {
        IpProtocol      protocol
        FromPort        fromPort
        ToPort          toPort
        CidrIp          cidr
    } 
end

def OutboundRule(protocol, fromPort, toPort, cidr)
    SecurityGroupEgress {
        IpProtocol      protocol
        FromPort        fromPort
        ToPort          toPort
        CidrIp          cidr
    } 
end

EC2_SecurityGroup("NatSecurityGroup"){
    GroupDescription    "Enable internal access to the NAT device"
    VpcId               Ref("Vpc")        
    InboundRule(    "tcp",      "0",    "65535",    "192.168.0.0/18")
    InboundRule(    "udp",      "0",    "65535",    "192.168.0.0/18")
    InboundRule(    "icmp",     "-1",   "-1",       "192.168.0.0/18") 
    OutboundRule(   "tcp",      "0",    "65535",    "192.168.0.0/18")
    OutboundRule(   "tcp",      "80",   "80",       "0.0.0.0/0")
    OutboundRule(   "tcp",      "443",  "443",      "0.0.0.0/0")        
    OutboundRule(   "icmp",     "-1",   "-1",       "0.0.0.0/0")
}
```` 

Instead of :

``` ruby
EC2_SecurityGroup("NatSecurityGroup"){
    GroupDescription    "Enable internal access to the NAT device"
    VpcId               Ref("Vpc")
    SecurityGroupIngress {
        IpProtocol      "tcp"
        FromPort        "0"
        ToPort          "65535"
        CidrIp          "192.168.0.0/18"
    }    
    SecurityGroupIngress {
        IpProtocol      "udp"
        FromPort        "0"
        ToPort          "65535"
        CidrIp          "192.168.0.0/18"
    }   
    SecurityGroupIngress {
        IpProtocol      "icmp"
        FromPort        "-1"
        ToPort          "-1"
        CidrIp          "192.168.0.0/18"
    }
    SecurityGroupEgress {
        IpProtocol      "tcp"
        FromPort        "0"
        ToPort          "65535"
        CidrIp          "192.168.0.0/18"
    }
    SecurityGroupEgress {
        IpProtocol      "tcp"
        FromPort        "80"
        ToPort          "80"
        CidrIp          "0.0.0.0/0"
    } 
    SecurityGroupEgress {
        IpProtocol      "tcp"
        FromPort        "443"
        ToPort          "443"
        CidrIp          "0.0.0.0/0"
    }     
    SecurityGroupEgress {
        IpProtocol      "icmp"
        FromPort        "-1"
        ToPort          "-1"
        CidrIp          "0.0.0.0/0"
    }
}
````