Defining SecurityGroupIngress in case of s3.get_object()

[mdalvi]

You have defined AWS::EC2::SecurityGroupEgress with bucket SourcePrefixListId for LambdaS3Write but that gives it capability to write only. It ain't reading from the bucket!

Let's say we are interested in doing,

client = boto3.client('s3', REGION_NAME, config=botocore.config.Config(s3={'addressing_style':'path'}))",
obj = client .get_object(Bucket=bucketname, Key=filename)

How would you define your AWS::EC2::SecurityGroupIngress condition that could enable reading from the same bucket?

"LambdaSecurityGroup": {
            "Type": "AWS::EC2::SecurityGroup",
            "Properties": {
                "GroupDescription": "Security Group for Lambda Egress",
                "VpcId": {
                    "Fn::GetAtt": [
                        "VPC",
                        "Outputs.VPC"
                    ]
                },
                "SecurityGroupEgress": [
                    {
                        "DestinationPrefixListId": {
                            "Ref": "S3EndpointPrefixList"
                        },
                        "IpProtocol": "-1"
                    }
                ],
                "SecurityGroupIngress": [
                    {
                        "SourcePrefixListId": {
                            "Ref": "S3EndpointPrefixList"
                        },
                        "IpProtocol": "-1"
                    }
                ]
            }
        },

I tried above, but doesn't work!