The fix is to replace:
VPCSecurityGroups: - Ref: TestDBSecurityGroup
with:
VPCSecurityGroups: - !GetAtt TestDBSecurityGroup.GroupId
Difference: