Want to define a different security group for each server range

nodes.pp

node /^tcsearch(0[1-9]|10)\.deskstaging\.com$/     inherits staging {                                                                                                                                                                          
  include elasticsearch                                                                                                                                                                                                                
}

node /^tcsearch2[0-9]\.deskstaging\.com$/          inherits staging {                                                                                                                                                                          
  include elasticsearch                                                                                                                                                                                                                
}

These two search clusters would run in tandem for a period of time. They run in different security groups. The security groups are used for discovery -- that is, all nodes in the same security group form the cluster. I have a templated configuration file (elasticsearch.yml.erb) and want to use a different security group depending on the node range.

E.g.,

discovery:
  type: ec2
  ec2:
    groups: <%= scope.lookupvar('search_security_group') %>

Where search_security_group could be tcsearch-group-01-10 or tcsearch-group-20-29.