security: narrow internal ingress CIDR (JIRA-4521)

[dylanratcliffe]

Summary

• Narrow internal ingress CIDR used for service/monitoring access.

Context

• JIRA-4521: Reduce internal exposure based on audit feedback.

Testing

• Terraform plan reviewed in CI.

Rollout / Risk

• If any internal tooling relies on the broader range, it may lose access; monitor health checks and alarms after merge.

[github-actions]

Open in Overmind ↗

---

model|risks_v6
✨Frontend Team Review

🟢 Change Signals

Routine 🟢 ▁ Ingress resources showing regular updates with 1 event/day for the last 4 weeks and 2 events/day for the last day.

View signals ↗

---

🔥 Risks

Narrowing SG ingress to 10.0.0.0/16 will block peer VPC (10.50.0.0/16) access to ports 8080/443/9090 ❗Medium Open Risk ↗
The internal-services security group will restrict ingress on ports 8080, 443, and 9090 from 10.0.0.0/8 to 10.0.0.0/16. The workloads VPC is 10.0.0.0/16, while a peered monitoring VPC uses 10.50.0.0/16. Today, clients in 10.50.0.0/16 can reach these ports via the broader 10.0.0.0/8 rule; after the change they will be blocked.

As a result, Prometheus scrapers, internal HTTPS clients, or other monitoring/mesh components running in 10.50.0.0/16 will fail to connect to the targets in the workloads VPC, leading to missing metrics, failed health/observability checks, and potential alert noise. Core service traffic within 10.0.0.0/16 will continue to work, but cross‑VPC internal traffic paths will break.

---

🟣 Expected Changes

~ ec2-security-group › sg-03cf38efd953aa056

--- current
+++ proposed
@@ -190,4 +190,11 @@
       to_port: 443
     - cidr_blocks:
+        - 203.0.113.122/32
+      description: NewCo 22
+      from_port: 443
+      protocol: tcp
+      self: false
+      to_port: 443
+    - cidr_blocks:
         - 203.0.113.16/30
       description: Acme Corp

~ ec2-security-group › sg-089e5107637083db5

--- current
+++ proposed
@@ -15,5 +15,5 @@
   ingress:
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Health check endpoint
       from_port: 8080
@@ -22,5 +22,5 @@
       to_port: 8080
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Internal HTTPS - monitoring, service mesh, internal tools
       from_port: 443
@@ -29,5 +29,5 @@
       to_port: 443
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Prometheus metrics scraping
       from_port: 9090

---

---

💥 Blast Radius

Items 74

Edges 228

[github-actions]

✅ Auto-Approved

---

🟢 Decision

Auto-approved: All safety checks passed

---

📊 Signals Summary

Routine 🟢 +1

---

🔥 Risks Summary

High 0 · Medium 1 · Low 0

---

💥 Blast Radius

Items 74 · Edges 228

---

View full analysis in Overmind ↗