VPC

1# Intentionally non-compliant fixture — DO NOT deploy, DO NOT sanitize.
2# Exercises: sg_no_public_admin_ingress failure path (SSH open to the internet).
3resource "aws_security_group" "bad_admin" {
4  name   = "bad-admin-sg"
5  vpc_id = "vpc-123"
6
7  ingress {
8    from_port   = 22
9    to_port     = 22
10    protocol    = "tcp"
11    cidr_blocks = ["0.0.0.0/0"]
12  }
13
14  # Redis also exposed via a port range covering 6379.
15  ingress {
16    from_port   = 6000
17    to_port     = 7000
18    protocol    = "tcp"
19    cidr_blocks = ["0.0.0.0/0"]
20  }
21}