At the moment, because it isn't possible to specify a security group from another region when allowing port access using amazon ec2's security groups, we have had to insert each individual IP into the security group that it needs access to. I can see this process becoming difficult to keep track of (it kind of already has).
My idea was to do something similar to what you can do between to Amazon VPCs (we can't switch to VPCs right now becauase the migration would be a little much at the moment), so have one server in each region acting as a gateway, where all requests from cross region servers come in. This gateway would then redirect the request to the proper endpoint. This way the security groups would only need one IP for cross region servers, rather than 1 per server.
Is this a valid technique? Are there other methods that might be better?