VPC

1# Intentionally non-compliant fixture — DO NOT deploy, DO NOT sanitize.
2# Exercises: db_sg_no_public_ingress failure path (5432 open to the internet).
3resource "aws_security_group" "bad" {
4  name   = "bad-db-sg"
5  vpc_id = "vpc-123"
6
7  ingress {
8    from_port   = 5432
9    to_port     = 5432
10    protocol    = "tcp"
11    cidr_blocks = ["0.0.0.0/0"]
12  }
13}