VPC

1# Compliant fixture — MUST pass (POLICY_OK).
2# Proves the IPv6 checks do NOT false-positive:
3#   - public web on 443 over both ::/0 and 0.0.0.0/0 (not a sensitive port)
4#   - SSH reachable over a scoped IPv6 prefix, not ::/0
5#   - Postgres reachable over a scoped IPv6 prefix, not ::/0
6# Also guards the reverse of the old regex bug: a benign ipv6_cidr_blocks list
7# declared before a benign cidr_blocks list must not be misread either way.
8resource "aws_security_group" "web_dualstack" {
9  name   = "web-dualstack-sg"
10  vpc_id = "vpc-123"
11
12  ingress {
13    from_port        = 443
14    to_port          = 443
15    protocol         = "tcp"
16    cidr_blocks      = ["0.0.0.0/0"]
17    ipv6_cidr_blocks = ["::/0"]
18  }
19
20  ingress {
21    from_port        = 22
22    to_port          = 22
23    protocol         = "tcp"
24    ipv6_cidr_blocks = ["2001:db8:1234::/48"]
25    cidr_blocks      = ["10.0.0.0/8"]
26  }
27
28  ingress {
29    from_port        = 5432
30    to_port          = 5432
31    protocol         = "tcp"
32    ipv6_cidr_blocks = ["2001:db8:1234::/48"]
33  }
34}