AWS CDK - Cyclical dependency in nested stack with Lambda and VPC

Error:

Template is undeployable, these resources have a dependency cycle: efsVpcAccessGroupfromtestwfmIngestionStackathenaHandlerSecurityGroup1FCBA9852049987DD57E -> IngestionStackNestedStackIngestionStackNestedStackResource9E86246D -> efsVpcAccessGroupfromtestwfmIngestionStackathenaHandlerSecurityGroup1FCBA9852049987DD57E:

    {
      "efsVpcAccessGroupfromtestwfmIngestionStackathenaHandlerSecurityGroup1FCBA9852049987DD57E": {
        "Type": "AWS::EC2::SecurityGroupIngress",
        "Properties": {
          "IpProtocol": "tcp",
          "Description": "from testwfmIngestionStackathenaHandlerSecurityGroup1FCBA985:2049",
          "FromPort": 2049,
          "GroupId": {
            "Fn::GetAtt": [
              "efsVpcAccessGroup1302B656",
              "GroupId"
            ]
          },
          "SourceSecurityGroupId": {
            "Fn::GetAtt": [
              "IngestionStackNestedStackIngestionStackNestedStackResource9E86246D",
              "Outputs.testwfmIngestionStackathenaHandlerSecurityGroup98F12823GroupId"
            ]
          },
          "ToPort": 2049
        }
      },
      "IngestionStackNestedStackIngestionStackNestedStackResource9E86246D": {
        "Type": "AWS::CloudFormation::Stack",
        "Properties": {
          "TemplateURL": {
            "Fn::Join": [
              "",
              [
                "https://s3.",
                {
                  "Ref": "AWS::Region"
                },
                ".",
                {
                  "Ref": "AWS::URLSuffix"
                },
                "/",
                {
                  "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                },
                "/60e5412e4ade9e638240a08786ab65fc32b6e800457ae9083d0e6717a1d3fd54.json"
              ]
            ]
          },
          "Parameters": {
            "referencetotestwfmWfmFileSystemAccessPoint945E440BRef": {
              "Ref": "WfmFileSystemAccessPointD78EC1FC"
            },
            "referencetotestwfmWfmFileSystemF61F523ERef": {
              "Ref": "WfmFileSystemC64F6910"
            },
            "referencetotestwfmEfsVpc536202AARef": {
              "Ref": "EfsVpc44B26922"
            },
            "referencetotestwfmEfsVpcPrivateSubnet1SubnetE760B7B6Ref": {
              "Ref": "EfsVpcPrivateSubnet1SubnetEABC52AC"
            },
            "referencetotestwfmEfsVpcPrivateSubnet2SubnetF51009E2Ref": {
              "Ref": "EfsVpcPrivateSubnet2SubnetB4120230"
            }
          }
        },
        "DependsOn": [
          "efsVpcAccessGroupfromtestwfmIngestionStackathenaHandlerSecurityGroup1FCBA9852049987DD57E",
          "WfmFileSystemEfsMountTarget1CEA97701",
          "WfmFileSystemEfsMountTarget2284AE797"
        ],
        "UpdateReplacePolicy": "Delete",
        "DeletionPolicy": "Delete"
      }
    }

Goal: Configure lambda within a NestedStack to have access to a EFS & VPC defined in parent stack.

Context: Parent stack defines the EFS and VPC combo, due to multiple child NestedStacks needing access to the EFS. Upon passing to child stacks, CDK attempts to synthesize an IngressRule on the VPC even if I've already manually configured a IPv4 wildcard on that port. Unsure on how to proceed, as doing a lookup in the NestedStacks feels like bad practice.