I wanted to modify a security group on some web servers that were behind an elastic load balancer so that they would only accept traffic from the load balancers. The problem was that  I wasn’t sure what IP address or security group to allow. As the IP would change all of the time, you just need to allow this built-in group as the source for your port: amazon-elb/amazon-elb-sg.

This will just permit YOUR load balancers to reach your webservers on your chosen ports such as 80 and 443, and you will notice that it will be renamed in the amazon console to something like this amazon-elb/sg-x00xx000 (amazon-elb-sg) .