VPC

1# Intentionally non-compliant fixture — DO NOT deploy, DO NOT sanitize.
2# Exercises the IPv6 public-ingress paths for BOTH security-group rules:
3#   - sg_no_public_admin_ingress via ipv6_cidr_blocks = ["::/0"] on SSH
4#   - db_sg_no_public_ingress    via ipv6_cidr_blocks = ["::/0"] on 5432
5# Regression shape: ipv6_cidr_blocks is declared BEFORE cidr_blocks and the IPv4
6# list is benign. The old r'cidr_blocks\s*=\s*\[' regex matched the tail of
7# `ipv6_cidr_blocks` first, so the checker read the IPv6 list while believing it
8# was reading IPv4, found no 0.0.0.0/0, and returned POLICY_OK.
9resource "aws_security_group" "bad_ipv6_admin" {
10  name   = "bad-ipv6-admin-sg"
11  vpc_id = "vpc-123"
12
13  ingress {
14    from_port        = 22
15    to_port          = 22
16    protocol         = "tcp"
17    ipv6_cidr_blocks = ["::/0"]
18    cidr_blocks      = ["10.0.0.0/8"]
19  }
20}
21
22resource "aws_security_group" "bad_ipv6_db" {
23  name   = "bad-ipv6-db-sg"
24  vpc_id = "vpc-123"
25
26  ingress {
27    from_port        = 5432
28    to_port          = 5432
29    protocol         = "tcp"
30    ipv6_cidr_blocks = ["::/0"]
31    cidr_blocks      = ["10.0.0.0/8"]
32  }
33}