VPC

1# Compliant fixture — MUST pass (POLICY_OK).
2# Proves sg_no_public_admin_ingress does NOT false-positive on legitimately
3# public ports: web (80/443) and a high app/game port range (7000-7100). None
4# of these are in the sensitive never-public list, so nothing should fire.
5resource "aws_security_group" "web" {
6  name   = "web-sg"
7  vpc_id = "vpc-123"
8
9  ingress {
10    from_port   = 443
11    to_port     = 443
12    protocol    = "tcp"
13    cidr_blocks = ["0.0.0.0/0"]
14  }
15
16  ingress {
17    from_port   = 80
18    to_port     = 80
19    protocol    = "tcp"
20    cidr_blocks = ["0.0.0.0/0"]
21  }
22
23  # Real-time game/UDP fleet on high ports — legitimately public, must NOT fire.
24  ingress {
25    from_port   = 7000
26    to_port     = 7100
27    protocol    = "udp"
28    cidr_blocks = ["0.0.0.0/0"]
29  }
30
31  # SSH present but scoped to a private admin CIDR — not public, must NOT fire.
32  ingress {
33    from_port   = 22
34    to_port     = 22
35    protocol    = "tcp"
36    cidr_blocks = ["10.0.0.0/8"]
37  }
38}