I was able to use params by adding a parameters section to the resources section. Apparently serverless will let you define anything that can go in a cloudformation template, not just resources.
Make sure you specify defaults, that is what serverless will use when you do a serverless deploy. My use case is that I want to be able override the default values when I use the generated cloudformation template directly e.g. in production.
Here is how I referenced the params:
- Ref: LambdaSecurityGroup