Required Security Group for all instances

Inbound:

Full access from the scanner networks
SSH access from the VPN and Bastion networks
ICMP types 0-8 from the 10 network

Outbound:

ICMP types 0-8 anywhere
DNS Access
Access to Proxy
Access to Salt
Access to Sensu