I'd like to be able to query the ARN of a security group, but queries like aws ec2 describe-security-groups only provide group IDs. Clearly security groups do have ARNs because API calls like aws datasync create-agent has options that require security group ARNs.