You have a circular dependency, and you need to break it.
My suggestion would be to move the security group resource out of the app module. Either handle it directly in the main part of the configuration, or move it into the networking module - assuming you have one like that for handling vpc/subnet/etc. The latter option would be prettier, I think.