VPC

1# Intentionally non-compliant fixture — DO NOT deploy, DO NOT sanitize.
2# Exercises: db_sg_no_public_ingress must still fire when from_port / to_port are
3# written as QUOTED integers (valid HCL: "5432" converts to 5432). Reading only
4# bare integers made this world-open database report POLICY_OK.
5resource "aws_security_group" "bad" {
6  name   = "bad-db-sg-quoted"
7  vpc_id = "vpc-123"
8
9  ingress {
10    from_port   = "5432"
11    to_port     = "5432"
12    protocol    = "tcp"
13    cidr_blocks = ["0.0.0.0/0"]
14  }
15}