AWS security groups allow rules to either be IP CIDR based or you can have rules that refer to other security groups, ignoring the IP addresses.