security: narrow internal ingress CIDR (JIRA-4521)

[dylanratcliffe]

Summary

• Narrow internal ingress CIDR used for service/monitoring access.

Context

• JIRA-4521: Reduce internal exposure based on audit feedback.

Testing

• Terraform plan reviewed in CI.

Rollout / Risk

• If any internal tooling relies on the broader range, it may lose access; monitor health checks and alarms after merge.

[github-actions]

Open in Overmind ↗

---

model|risks_v6
✨Frontend Team Review

🟢 Change Signals

Routine 🟢 ▁▂ Ingress resources showing regular updates with 1 event/day for the last 5 weeks and 2 events/day for the last day.

View signals ↗

---

🔥 Risks

Narrowing sg-089e5107637083db5 to 10.0.0.0/16 blocks cross‑VPC NLB health checks from 10.50.0.0/16 on port 9090 ❗Medium Open Risk ↗
The internal-services security group currently allows 8080, 443, and 9090 from 10.0.0.0/8. The change narrows these to 10.0.0.0/16. Instance i-0f2ddb4fd6ffe519d (10.0.101.181) uses this group and is an IP target of the internal NLB mon-internal-terraform-example in a peered VPC (10.50.0.0/16). The NLB’s target group (api-health-terraform-example) actively health-checks and scrapes 9090 and is healthy now.

After the change, traffic sourced from the NLB nodes in 10.50.0.0/16 will be blocked by the tightened SG, causing health checks and monitoring traffic on 9090 to fail. The target will flip to unhealthy and cross‑VPC monitoring/metrics collection will stop, creating a monitoring blind spot and potential alerting gaps for the production API server.

---

🟣 Expected Changes

~ ec2-security-group › sg-03cf38efd953aa056

--- current
+++ proposed
@@ -204,4 +204,11 @@
       to_port: 443
     - cidr_blocks:
+        - 203.0.113.124/32
+      description: NewCo 24
+      from_port: 443
+      protocol: tcp
+      self: false
+      to_port: 443
+    - cidr_blocks:
         - 203.0.113.16/30
       description: Acme Corp

~ ec2-security-group › sg-089e5107637083db5

--- current
+++ proposed
@@ -15,5 +15,5 @@
   ingress:
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Health check endpoint
       from_port: 8080
@@ -22,5 +22,5 @@
       to_port: 8080
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Internal HTTPS - monitoring, service mesh, internal tools
       from_port: 443
@@ -29,5 +29,5 @@
       to_port: 443
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Prometheus metrics scraping
       from_port: 9090

---

---

💥 Blast Radius

Items 89

Edges 277

[github-actions]

✅ Auto-Approved

---

🟢 Decision

Auto-approved: All safety checks passed

---

📊 Signals Summary

Routine 🟢 +2

---

🔥 Risks Summary

High 0 · Medium 1 · Low 0

---

💥 Blast Radius

Items 89 · Edges 277

---

View full analysis in Overmind ↗