The replace environment goal copies over non-custom (elastic beanstalk created) security groups to the new environment if the old environment contains custom security groups

[edwinquaihoi]

During a "replace environment" operation the security groups of the source environment are copied over to the target environment. However if the the source environment contains both custom and non-custom security groups, the code incorrectly copies all security groups. This creates a referential integrity exception later on when the source environment is being terminated because one of its non-custom security groups is now being referenced in the target environment.

Note: As a workaround you need to manually deference the non-custom security group in the target environment and then manually terminate the source environment.