VPC

1# Compliant fixture — DB ingress scoped to an app SG. MUST pass (POLICY_OK).
2resource "aws_security_group" "app" {
3  name   = "app-sg"
4  vpc_id = "vpc-123"
5}
6
7resource "aws_security_group" "good" {
8  name   = "good-db-sg"
9  vpc_id = "vpc-123"
10
11  ingress {
12    from_port       = 5432
13    to_port         = 5432
14    protocol        = "tcp"
15    security_groups = [aws_security_group.app.id]
16  }
17
18  # A non-DB port open to the internet (e.g. HTTPS) must NOT trip the DB-port rule.
19  ingress {
20    from_port   = 443
21    to_port     = 443
22    protocol    = "tcp"
23    cidr_blocks = ["0.0.0.0/0"]
24  }
25}
26
27# Separate ingress-rule resource opening 5432 to the world: fail-open by design
28# (this static reader cannot correlate it to its SG), so it must NOT be flagged.
29resource "aws_vpc_security_group_ingress_rule" "separate" {
30  security_group_id = aws_security_group.good.id
31  from_port         = 5432
32  to_port           = 5432
33  ip_protocol       = "tcp"
34  cidr_ipv4         = "0.0.0.0/0"
35}