1. 首先，在源安全组的“出站”规则中添加此安全组的EKS工作节点组的SG ID。如果EKS集群和SG位于不同的AWS账户中，则需要使用跨账户功能来实现此目的。

    "Type": "AWS::EC2::SecurityGroupIngress",
    "Properties": {
        "Description" : "Allow outbound traffic to EKS worker nodes security group across account",
        "GroupId": "sg-xxxxxxx", # source security group ID
        "IpProtocol": "tcp",
        "FromPort": "0",
        "ToPort": "65535",
        "SourceSecurityGroupId": "sg-yyyyyyy", # destination EKS worker nodes security group ID
        "SourceSecurityGroupName": "",
        "SourceSecurityGroupOwnerId": "xxxxxxxxxxxx" # destination AWS account ID
    }

2. 接下来，在接收请求的安全组的“入站”规则中添加源EKS工作节点组的SG ID。此处也要注意跨账户的情况。

    "Type": "AWS::EC2::SecurityGroupIngress",
    "Properties": {
        "Description" : "Allow incoming traffic from EKS worker nodes security group across account",
        "GroupId": "sg-yyyyyyy", # destination security group ID
        "IpProtocol": "tcp",
        "FromPort": "0",
        "ToPort": "65535",
        "SourceSecurityGroupId": "sg-xxxxxxx", # source EKS worker nodes security group ID
        "SourceSecurityGroupName": "",
        "SourceSecurityGroupOwnerId": "yyyyyyyyyyyy" # source AWS account ID
    }

注意：使用跨账户功能需要确保已经通过AWS IAM设置了角色和权限。