Q: Why is SG mutation though connections recommended? I am building a new Stack with AWS CDK. I am confused with the creation of AutoScaling Groups for example. A Security Group is created by default. You can of course modify it, but the construct does not take any existing SG in its constructor. If we refer to the documentation:

If you are defining new infrastructure in CDK, there is a good chance you won't have to interact with this class at all. Like IAM Roles, Security Groups need to exist to control access between AWS resources, but CDK will automatically generate and populate them with least-privilege permissions for you so you can concentrate on your business logic.
All Constructs that require Security Groups will create one for you if you don't specify one at construction. After construction, you can selectively allow connections to and between constructs via--for example-- the instance.connections object. Think of it as "allowing connections to your instance", rather than "adding ingress rules a security group". See the Allowing Connections section in the library documentation for examples.
Direct manipulation of the Security Group through addIngressRule and addEgressRule is possible, but mutation through the .connections object is recommended.

My question is then, why recommending the default creation (and mutation) of a new SG at the creation of each component of the Stack. Why not using an existing SG so that it is easier to update only one SG if rules change ?
