security: narrow internal ingress CIDR (JIRA-4521)

[dylanratcliffe]

Summary

• Narrow internal ingress CIDR used for service/monitoring access.

Context

• JIRA-4521: Reduce internal exposure based on audit feedback.

Testing

• Terraform plan reviewed in CI.

Rollout / Risk

• If any internal tooling relies on the broader range, it may lose access; monitor health checks and alarms after merge.

[github-actions]

Open in Overmind ↗

---

model|risks_v6
✨Frontend Team Review

🟢 Change Signals

Routine 🟢 ▁ Ingress resources showing regular updates with 1 event/day for the last 2 weeks and 2 events/day for the last day, maintaining typical patterns.

View signals ↗

---

🔥 Risks

Narrowing sg-08c3767d4eeede7b5 to 10.0.0.0/16 will block monitoring VPC (10.50.0.0/16) health checks to 10.0.101.248:9090 ❗Medium Open Risk ↗
Security group sg-08c3767d4eeede7b5 currently allows 9090, 443, and 8080 from 10.0.0.0/8 and is attached to the production API instance at 10.0.101.248. The proposed change restricts these ports to 10.0.0.0/16 only. The monitoring VPC (10.50.0.0/16) is peered to the workloads VPC and runs an internal NLB whose target group points at 10.0.101.248:9090 for health/metrics.

When the CIDR is narrowed, connections originating from the monitoring VPC (e.g., NLB health checks from 10.50.x.x) will be blocked by sg-08c3767d4eeede7b5 on port 9090. The NLB target 10.0.101.248 will be marked unhealthy, breaking cross‑VPC monitoring and Prometheus/health probes and likely triggering the associated alarms.

---

🟣 Expected Changes

~ ec2-security-group › sg-085ee012c9855643f

--- current
+++ proposed
@@ -99,4 +99,11 @@
       to_port: 443
     - cidr_blocks:
+        - 203.0.113.109/32
+      description: NewCo 9
+      from_port: 443
+      protocol: tcp
+      self: false
+      to_port: 443
+    - cidr_blocks:
         - 203.0.113.16/30
       description: Acme Corp

~ ec2-security-group › sg-08c3767d4eeede7b5

--- current
+++ proposed
@@ -15,5 +15,5 @@
   ingress:
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Health check endpoint
       from_port: 8080
@@ -22,5 +22,5 @@
       to_port: 8080
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Internal HTTPS - monitoring, service mesh, internal tools
       from_port: 443
@@ -29,5 +29,5 @@
       to_port: 443
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Prometheus metrics scraping
       from_port: 9090

---

---

💥 Blast Radius

Items 91

Edges 251

[github-actions]

✅ Auto-Approved

---

🟢 Decision

Auto-approved: All safety checks passed

---

📊 Signals Summary

Routine 🟢 +1

---

🔥 Risks Summary

High 0 · Medium 1 · Low 0

---

💥 Blast Radius

Items 91 · Edges 251

---

View full analysis in Overmind ↗