fix(FLEETMDM-008): CU-86akj32d7 fleet-terraform module source pinned to a floating semver ref for byo-vpc without version pin verification

[flamingo]

Closes findings from rule FLEETMDM-008 — fleet-terraform module source pinned to a floating semver ref for byo-vpc without version pin verification.

Draft — this is a starting point, not a finished change. The fix required judgment, so read it before trusting it.

#	Fix confidence	Finding	Location
1	🔴 30 low — review closely	fleet-terraform module source pinned to a floating semver ref for byo-vpc without version pin verification	infrastructure/loadtesting/terraform/infra/main.tf:33

What changed — and what was deliberately left — is explained per finding as inline review comments on the lines each finding touched.

---

Run: https://product-hub.flamingo.so/admin/code-review
Run id: 1446a072-096e-4294-8082-c7cadffe76de

Merging this PR is recorded as acceptance of the rule that produced it;
closing it unmerged is recorded as rejection. Both feed rule health, so
closing a wrong suggestion is useful rather than merely tidy.

ClickUp task: CU-86akj32d7 FleetMDM bulk review findings sweep (12 PRs)

[flamingo]

🦩 What this fix changed, finding by finding

1 finding(s) fixed in this draft — 1 explained inline on the diff; 1 low-confidence hunk(s) need close review before merging.

[flamingo]

🦩 🔴 fleet-terraform module source pinned to a floating semver ref for byo-vpc without version pin verification

Added explanatory comments in infrastructure/loadtesting/terraform/infra/main.tf: a block comment immediately above the module "loadtest" block documenting the full set of currently-pinned fleet-terraform module refs (root v1.26.1, ses v1.4.1, migrations v2.2.2, external-vuln-scans v2.5.0, mdm v2.0.0, osquery-carve v1.3.1, logging-alb v2.2.2) and stating that they must be reviewed together on any bump, plus an inline comment above rds_config.engine_version/snapshot_identifier calling out their coupling to the root module ref. This documents the version-floor intent inline as the finding requests, but it does NOT add any CI validation of cross-module compatibility (no such mechanism exists in this file and adding one would require a script/workflow outside this file's scope), so the underlying risk that a ref bump could silently break compatibility remains unmitigated — a complete fix would require a CI check (e.g. a script asserting known-good version combinations) in the repository's CI configuration, which is out of scope for a single-file change.

🤖 Prompt for AI agents

In infrastructure/loadtesting/terraform/infra/main.tf around line 33, review and complete this code-review fix: fleet-terraform module source pinned to a floating semver ref for byo-vpc without version pin verification.
What the draft fix changed: Added explanatory comments in `infrastructure/loadtesting/terraform/infra/main.tf`: a block comment immediately above the `module "loadtest"` block documenting the full set of currently-pinned fleet-terraform module refs (root v1.26.1, ses v1.4.1, migrations v2.2.2, external-vuln-scans v2.5.0, mdm v2.0.0, osquery-carve v1.3.1, logging-alb v2.2.2) and stating that they must be reviewed together on any bump, plus an inline comment above `rds_config.engine_version`/`snapshot_identifier` calling out their coupling to the root module ref. This documents the version-floor intent inline as the finding requests, but it does NOT add any CI validation of cross-module compatibility (no such mechanism exists in this file and adding one would require a script/workflow outside this file's scope), so the underlying risk that a ref bump could silently break compatibility remains unmitigated — a complete fix would require a CI check (e.g. a script asserting known-good version combinations) in the repository's CI configuration, which is out of scope for a single-file change.
The fix is LOW CONFIDENCE — verify it is correct and finish whatever it left incomplete.

fix confidence: 🔴 30 low — review closely — react 👍/👎 to teach the reviewer