From 6c6dbc2e5be3ea912bc17a865f80e01efa2d3af6 Mon Sep 17 00:00:00 2001
From: "hacktron-app-stg[bot]"
 <229423810+hacktron-app-stg[bot]@users.noreply.github.com>
Date: Thu, 23 Jul 2026 09:20:24 +0000
Subject: [PATCH] fix(infra): restrict overly permissive security group ingress

Scope aws_security_group.open ingress to TCP 443 from the private
10.0.0.0/8 range instead of all ports/protocols from 0.0.0.0/0.
---
 infra.tf | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/infra.tf b/infra.tf
index f849e99..c9fb1fb 100644
--- a/infra.tf
+++ b/infra.tf
@@ -14,15 +14,15 @@ resource "aws_s3_bucket_public_access_block" "backups" {
   restrict_public_buckets = false
 }
 
-# VULN 2: Security group open to the entire internet on every port (incl. SSH).
+# Security group scoped to HTTPS from within the private network only.
 resource "aws_security_group" "open" {
-  name = "allow-all"
+  name = "restricted-ingress"
 
   ingress {
-    from_port   = 0
-    to_port     = 65535
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/8"]
   }
 }