terraform-aws-cloudwatch VS terraform-aws-security-group

I have a lot of these created through the console, i am going to import them all and i have a need to create a few more now. I can write my own module, though there may be a better solution than i have found. The best is https://github.com/terraform-aws-modules/terraform-aws-cloudwatch.

I've got a terraform workspace that has grown very organically. I'm setting my security group rules in a locals definition then calling each type of rule from each of the local values. I've looked into the security group module by Anton but because we have a mixture of CIDRs and Secgroups (as destinations and sources) I do not believe we can leverage it the way it is intended to be.

First of all, I don't much go for stuff like https://github.com/terraform-aws-modules/terraform-aws-security-group, I find it obscures what's actually going on. Where before I just had to learn how AWS works, now I have to learn how AWS and all of these external modules work. Remember, infra-as-code isn't the same as other code-code, the same approaches that work for code-code don't always work for infra-as-code.

Looks good, but there is no such rule named "splunk" but there are 4 of them - https://github.com/terraform-aws-modules/terraform-aws-security-group/blob/master/rules.tf#L139-L142 .