security: narrow internal ingress CIDR (JIRA-4521)

[dylanratcliffe]

Summary

• Narrow internal ingress CIDR used for service/monitoring access.

Context

• JIRA-4521: Reduce internal exposure based on audit feedback.

Testing

• Terraform plan reviewed in CI.

Rollout / Risk

• If any internal tooling relies on the broader range, it may lose access; monitor health checks and alarms after merge.

[github-actions]

Open in Overmind ↗

---

model|risks_v6
✨Frontend Team Review

🟢 Change Signals

Routine 🟢 ▁ 2 events/day for the last day

View signals ↗

---

🧠 Reasoning · ✖ 0 · ✔ 1

Security group ingress CIDR narrowing blocking internal health/monitoring traffic

Observations 6

Hypothesis

Narrowing ingress CIDR ranges on security group sg-089e5107637083db5 from 10.0.0.0/8 to 10.0.0.0/16 for ports 8080, 9090, and 443 will block traffic from internal/private IPs in 10.0.0.0/8 that fall outside 10.0.0.0/16 (e.g., 10.1.x.x, 10.2.x.x, 10.200.x.x). Any instances and ENIs using this security group may become unreachable from those addresses for health checks, Prometheus/monitoring scrapes, internal HTTPS, service-mesh communication, and load balancer or peer components that still assume access from the broader 10.0.0.0/8 space. This can lead to failed health checks, degraded monitoring visibility, and traffic disruption if dependent systems reside outside the /16.

Investigation

I reviewed the diff for sg-089e5107637083db5 and confirmed it narrows ingress on ports 8080, 9090, and 443 from 10.0.0.0/8 to 10.0.0.0/16. Current state shows the security group indeed allows 10.0.0.0/8 on those ports. The instances using this SG (notably i-084178432f016fcd2 at 10.0.101.222) live in VPC vpc-02901bcbb89561298, which has CIDR 10.0.0.0/16. I also found an internal Target Group (api-health-terraform-example) in a different VPC (vpc-096b686376892bb49) that is currently health checking 10.0.101.222 on port 9090 and reporting healthy. Because the target group’s load balancer nodes originate traffic from subnets in their own VPC, and VPC peering/transit requires non-overlapping CIDRs, that source CIDR cannot be 10.0.0.0/16. Today it works due to the broader 10.0.0.0/8 rule; after narrowing to 10.0.0.0/16, those cross‑VPC health checks (and any other internal callers in other 10.x ranges) will be blocked. I found no compensating allow rules or SG references that would keep this traffic open. Therefore the hypothesis describes a real and specific breakage mechanism.

✔ Hypothesis proven

---

🔥 Risks

Narrowing SG to 10.0.0.0/16 will block cross‑VPC health/monitoring traffic to 10.0.101.222 on 9090 and internal 443/8080 ❗Medium Open Risk ↗
The internal-services security group will restrict ingress on ports 8080, 9090, and 443 from 10.0.0.0/8 to 10.0.0.0/16. The production API instance at 10.0.101.222 uses this group, while an internal target group in a different VPC is actively health checking 10.0.101.222:9090 and is currently healthy.

Because the health/monitoring load balancer sources traffic from its own VPC’s subnets (which cannot overlap the workload VPC 10.0.0.0/16), narrowing to 10.0.0.0/16 will exclude those source IPs. Health checks and Prometheus scrapes from that VPC will be rejected, flipping the target to unhealthy and degrading monitoring visibility. Any other internal callers in 10.x.x.x outside 10.0.0.0/16 will also lose access on these ports.

---

🟣 Expected Changes

~ ec2-security-group › sg-089e5107637083db5

--- current
+++ proposed
@@ -15,5 +15,5 @@
   ingress:
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Health check endpoint
       from_port: 8080
@@ -22,5 +22,5 @@
       to_port: 8080
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Internal HTTPS - monitoring, service mesh, internal tools
       from_port: 443
@@ -29,5 +29,5 @@
       to_port: 443
     - cidr_blocks:
-        - 10.0.0.0/8
+        - 10.0.0.0/16
       description: Prometheus metrics scraping
       from_port: 9090

---

---

💥 Blast Radius

Items 19

Edges 79

[github-actions]

✅ Auto-Approved

---

🟢 Decision

Auto-approved: All safety checks passed

---

📊 Signals Summary

Routine 🟢 +1

---

🔥 Risks Summary

High 0 · Medium 1 · Low 0

---

💥 Blast Radius

Items 19 · Edges 79

---

View full analysis in Overmind ↗