title: Terraform - AWS - CreateSecurityGroup - parameter GroupName is invalid. Group names may not be in the format sg-*
body: <p>I am trying to create an AWS EKS cluster using terraform and in the sequence of steps, I have a step to create a security group where I get an error to which I couldn't get a solution.</p>
  <p>Could you guys have a look and help me understand why is this error occurring.</p>
  <p>Using terraform version v0.13.1</p>
  <p>Request &amp; Response Logs:</p>
  <pre><code>2020-09-03T17:10:09.598+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: Action=CreateSecurityGroup&amp;GroupDescription=Managed+by+Te
  rraform&amp;GroupName=sg-worker_group_mgmt_two2020090311400XXXXXXXXXXXX&amp;Version=2016-11-15&amp;VpcId=vpc-XXXXXXXX
  2020-09-03T17:10:09.598+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: -----------------------------------------------------
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: 2020/09/03 17:10:10 [DEBUG] [aws-sdk-go] DEBUG: Response 
  ec2/CreateSecurityGroup Details:
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: ---[ RESPONSE ]--------------------------------------
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: HTTP/1.1 400 Bad Request
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: Connection: close
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: Transfer-Encoding: chunked
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: Date: Thu, 03 Sep 2020 11:40:09 GMT
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: Server: AmazonEC2
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: 
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: 
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: -----------------------------------------------------
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: 2020/09/03 17:10:10 [DEBUG] [aws-sdk-go] &lt;?xml version=&quot;1
  .0&quot; encoding=&quot;UTF-8&quot;?&gt;
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: &lt;Response&gt;&lt;Errors&gt;&lt;Error&gt;&lt;Code&gt;InvalidParameterValue&lt;/Cod
  e&gt;&lt;Message&gt;Value (sg-worker_group_mgmt_two2020090311400XXXXXXXXXXXX) for parameter GroupName is invalid. Group names may not be in the
   format sg-*.&lt;/Message&gt;&lt;/Error&gt;&lt;/Errors&gt;&lt;RequestID&gt;5XXXX-0XXX-4c55-aXXa-b34f3XXXXX&lt;/RequestID&gt;&lt;/Response&gt;
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5: 2020/09/03 17:10:10 [DEBUG] [aws-sdk-go] DEBUG: Validate 
  Response ec2/CreateSecurityGroup failed, attempt 0/25, error InvalidParameterValue: Value (sg-worker_group_mgmt_two2020090311400XXXXXXXXXXXX) for parameter GroupName is invalid. Group names may not be in the format sg-*.
  2020-09-03T17:10:10.360+0530 [DEBUG] plugin.terraform-provider-aws_v3.4.0_x5:   status code: 400, request id: 5XXXX-0XXX-4c55-aXXa-b34f3XXXXX
  2020/09/03 17:10:10 [DEBUG] aws_security_group.worker_group_mgmt_two: apply errored, but we're indicating that via the Error pointer rather than returning it: Error creating Security Group: InvalidParameterValue: Value (sg-worker_group_mgmt_two2020090311400XXXXXXXXXXXX) for parameter GroupName is invalid. Group names may not be in the format sg-*.
          status code: 400, request id: 5XXXX-0XXX-4c55-aXXa-b34f3XXXXX
  </code></pre>
  <p>Terraform code:</p>
  <pre><code>
  resource &quot;aws_security_group&quot; &quot;sg-worker_group_mgmt_one&quot; {
    name_prefix = &quot;sg-worker_group_mgmt_one&quot;
    vpc_id      = &quot;${data.aws_vpc.vpc-dev-cluster.id}&quot;
  
    ingress {
      from_port = 22
      to_port   = 22
      protocol  = &quot;tcp&quot;
  
      cidr_blocks = [
        &quot;xxx.xx.0.0/16&quot;,
      ]
    }
  }
  
  resource &quot;aws_security_group&quot; &quot;sg-worker_group_mgmt_two&quot; {
    name_prefix = &quot;sg-worker_group_mgmt_two&quot;
    vpc_id      = &quot;${data.aws_vpc.vpc-dev-cluster.id}&quot;
  
    ingress {
      from_port = 22
      to_port   = 22
      protocol  = &quot;tcp&quot;
  
      cidr_blocks = [
        &quot;xxx.xx.0.0/16&quot;,
      ]
    }
  }
  
  resource &quot;aws_security_group&quot; &quot;sg-all_worker_mgmt&quot; {
    name_prefix = &quot;sg-all_worker_management&quot;
    vpc_id      = &quot;${data.aws_vpc.vpc-dev-cluster.id}&quot;
  
    ingress {
      from_port = 22
      to_port   = 22
      protocol  = &quot;tcp&quot;
  
      cidr_blocks = [
        &quot;xxx.xx.xx.0/17&quot;,
        &quot;xxx.xx.0.0/16&quot;,
      ]
    }
  }
  
  
  resource &quot;aws_security_group&quot; &quot;sg-eks_cluster&quot; {
    name        = &quot;${var.cluster_sg_name}&quot;
    description = &quot;Cluster communication with worker nodes&quot;
    vpc_id      = &quot;${data.aws_vpc.vpc-dev-cluster.id}&quot;
  
    tags = {
      Name = &quot;${var.cluster_sg_name}&quot;
    }
  }
  
  resource &quot;aws_security_group_rule&quot; &quot;sg-cluster_inbound&quot; {
    description              = &quot;Allow worker nodes to communicate with the cluster API Server&quot;
    from_port                = 443
    protocol                 = &quot;tcp&quot;
    security_group_id        = &quot;${aws_security_group.sg-eks_cluster.id}&quot;
    source_security_group_id = &quot;${aws_security_group.sg-eks_nodes.id}&quot;
    to_port                  = 443
    type                     = &quot;ingress&quot;
  }
  
  resource &quot;aws_security_group_rule&quot; &quot;sg-cluster_outbound&quot; {
    description              = &quot;Allow cluster API Server to communicate with the worker nodes&quot;
    from_port                = 1024
    protocol                 = &quot;tcp&quot;
    security_group_id        = &quot;${aws_security_group.sg-eks_cluster.id}&quot;
    source_security_group_id = &quot;${aws_security_group.sg-eks_nodes.id}&quot;
    to_port                  = 65535
    type                     = &quot;egress&quot;
  }
  
  resource &quot;aws_security_group&quot; &quot;sg-eks_nodes&quot; {
    name        = &quot;${var.nodes_sg_name}&quot;
    description = &quot;Security group for all nodes in the cluster&quot;
    vpc_id      = &quot;${data.aws_vpc.vpc-dev-cluster.id}&quot;
  
    egress {
      from_port   = 0
      to_port     = 0
      protocol    = &quot;-1&quot;
      cidr_blocks = [&quot;0.0.0.0/0&quot;]
    }
  
    tags = {
      Name = &quot;${var.nodes_sg_name}&quot;
      &quot;kubernetes.io/cluster/${var.eks_cluster_name}&quot; = &quot;owned&quot;
    }
  }
  
  resource &quot;aws_security_group_rule&quot; &quot;nodes&quot; {
    description              = &quot;Allow nodes to communicate with each other&quot;
    from_port                = 0
    protocol                 = &quot;-1&quot;
    security_group_id        = &quot;${aws_security_group.sg-eks_nodes.id}&quot;
    source_security_group_id = &quot;${aws_security_group.sg-eks_nodes.id}&quot;
    to_port                  = 65535
    type                     = &quot;ingress&quot;
  }
  
  resource &quot;aws_security_group_rule&quot; &quot;nodes_inbound&quot; {
    description              = &quot;Allow worker Kubelets and pods to receive communication from the cluster control plane&quot;
    from_port                = 1025
    protocol                 = &quot;tcp&quot;
    security_group_id        = &quot;${aws_security_group.sg-eks_nodes.id}&quot;
    source_security_group_id = &quot;${aws_security_group.sg-eks_cluster.id}&quot;
    to_port                  = 65535
    type                     = &quot;ingress&quot;
  }
  
  </code></pre>