security: narrow internal ingress CIDR (JIRA-4521)

[dylanratcliffe]

Summary

• Narrow internal ingress CIDR used for service/monitoring access.

Context

• JIRA-4521: Reduce internal exposure based on audit feedback.

Testing

• Terraform plan reviewed in CI.

Rollout / Risk

• If any internal tooling relies on the broader range, it may lose access; monitor health checks and alarms after merge.

[github-actions]

Open in Overmind ↗

---

model|risks_v6
✨Frontend Team Review

🟢 Change Signals

Routine 🟢 ▁ Ingress resources showing regular updates with 1 event/day for the last 13 days and 2 events/day for the last day.

View signals ↗

---

🔥 Risks

[!NOTE] > Overmind has not identified any risks associated with this change
This could be due to the change being low risk with no impact on other parts of the system, or involving resources that Overmind currently does not support.

---

🟣 Expected Changes

~ ec2-security-group › sg-085ee012c9855643f

--- current
+++ proposed
@@ -92,4 +92,11 @@
       to_port: 443
     - cidr_blocks:
+        - 203.0.113.108/32
+      description: NewCo 8
+      from_port: 443
+      protocol: tcp
+      self: false
+      to_port: 443
+    - cidr_blocks:
         - 203.0.113.16/30
       description: Acme Corp

~ ec2-security-group › sg-08c3767d4eeede7b5

--- current
+++ proposed
@@ -15,5 +15,5 @@
   ingress:
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Health check endpoint
       from_port: 8080
@@ -22,5 +22,5 @@
       to_port: 8080
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Internal HTTPS - monitoring, service mesh, internal tools
       from_port: 443
@@ -29,5 +29,5 @@
       to_port: 443
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Prometheus metrics scraping
       from_port: 9090

---

---

💥 Blast Radius

Items 44

Edges 195

[github-actions]

✅ Auto-Approved

---

🟢 Decision

Auto-approved: All safety checks passed

---

📊 Signals Summary

Routine 🟢 +1

---

🔥 Risks Summary

High 0 · Medium 0 · Low 0

---

💥 Blast Radius

Items 44 · Edges 195

---

View full analysis in Overmind ↗