[Security] Restrict internet-access security group to API requirements only

[jameslaneovermind]

Summary

Restricts the internet-access security group egress rules to only the ports required by the API server, addressing findings from the Q4 security audit.

Context

Security audit (REF: SEC-2024-Q4-047) identified that the internet-access security group has overly permissive egress rules allowing all outbound traffic. After reviewing the API server's actual network requirements, we only need port 8080 for outbound HTTP traffic to our external analytics service.

Changes

• Before: Security group allows all egress traffic (0.0.0.0/0 on all ports)
• After: Security group allows egress only on port 8080/TCP to 0.0.0.0/0
• Updated description to reflect "API outbound traffic only"

Testing

• ✅ Verified API server connectivity to analytics service (port 8080)
• ✅ Confirmed no other ports are used by the API in staging environment
• ✅ Reviewed CloudWatch logs for any blocked connections over past 30 days

Terraform Plan

[env0]

🚀  env0 had composed a PR Plan for environment Overmind / Terraform Example / production :

Plan: 1 to add, 2 to change, 0 to destroy.

Plan Details

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
+   create
!   update in-place

Terraform will perform the following actions:


  # module.api_access[0].aws_sns_topic_subscription.oncall_email will be created
+   resource "aws_sns_topic_subscription" "oncall_email" {
+       arn                             = (known after apply)
+       confirmation_timeout_in_minutes = 1
+       confirmation_was_authenticated  = (known after apply)
+       endpoint                        = "[email protected]"
+       endpoint_auto_confirms          = false
+       filter_policy_scope             = (known after apply)
+       id                              = (known after apply)
+       owner_id                        = (known after apply)
+       pending_confirmation            = (known after apply)
+       protocol                        = "email"
+       raw_message_delivery            = false
+       topic_arn                       = "arn:aws:sns:eu-west-2:540044833068:production-api-alerts"
    }

  # module.heritage[0].aws_rds_cluster.face_database will be updated in-place
!   resource "aws_rds_cluster" "face_database" {
        id                                    = "facial-recognition-terraform-example"
        tags                                  = {}
        # (46 unchanged attributes hidden)

        # (1 unchanged block hidden)
    }

  # module.shared_security_group.aws_security_group.internet_access[0] will be updated in-place
!   resource "aws_security_group" "internet_access" {
!       egress                 = [
-           {
-               cidr_blocks      = [
-                   "0.0.0.0/0",
                ]
-               description      = "Allow all outbound traffic"
-               from_port        = 0
-               ipv6_cidr_blocks = []
-               prefix_list_ids  = []
-               protocol         = "-1"
-               security_groups  = []
-               self             = false
-               to_port          = 0
            },
+           {
+               cidr_blocks      = [
+                   "0.0.0.0/0",
                ]
+               description      = "API outbound traffic only"
+               from_port        = 8080
+               ipv6_cidr_blocks = []
+               prefix_list_ids  = []
+               protocol         = "tcp"
+               security_groups  = []
+               self             = false
+               to_port          = 8080
            },
        ]
        id                     = "sg-0437857de45b640ce"
        name                   = "internet-access"
        tags                   = {
            "Environment" = "production"
            "ManagedBy"   = "terraform"
            "Name"        = "internet-access"
            "Project"     = "platform-services"
            "Purpose"     = "General outbound access"
            "Team"        = "platform"
        }
        # (7 unchanged attributes hidden)
    }

Plan: 1 to add, 2 to change, 0 to destroy.

Failed to calculate cost estimation

Full PR Plan logs on env0

[github-actions]

Open in Overmind ↗

---

model|risks_v6

🔴 Change Signals

Routine 🔴 ▅▃▂▁ The AWS security group 'egress' attribute showing its first ever modification, which is unusual compared to typical patterns.

View signals ↗

---

🔥 Risks

Restricting sg-0437857de45b640ce egress to TCP/8080 will block DNS/HTTPS/IMDS and break outbound connectivity for attached EC2 instances ‼️High Open Risk ↗
The change narrows egress on security group sg-0437857de45b640ce from all protocols/ports to only TCP port 8080. This SG is the sole outbound policy on EC2 instances i-060c5af731ee54cc9 and i-0e205109677d47e83. Once applied, these instances will be unable to make DNS queries (UDP/TCP 53), reach HTTPS endpoints (443), or access the instance metadata service (169.254.169.254:80), and any other non‑8080 dependencies will be blocked.

As a result, name resolution, credential retrieval via IMDS, package updates, external API calls, and any database or service connections on non‑8080 ports will fail, leading to application errors and operational degradation on these hosts.

---

🟣 Expected Changes

~ ec2-security-group › sg-0437857de45b640ce

--- current
+++ proposed
@@ -7,9 +7,9 @@
     - cidr_blocks:
         - 0.0.0.0/0
-      description: Allow all outbound traffic
-      from_port: 0
-      protocol: "-1"
+      description: API outbound traffic only
+      from_port: 8080
+      protocol: tcp
       self: false
-      to_port: 0
+      to_port: 8080
   id: sg-0437857de45b640ce
   ingress:

---

🟠 Unmapped Changes

+ aws_sns_topic_subscription › module.api_access[0].aws_sns_topic_subscription.oncall_email

--- current
+++ proposed
@@ -0,0 +1,22 @@
+type: aws_sns_topic_subscription
+id: github.com/overmindtech/terraform-example.aws_sns_topic_subscription.module.api_access[0].aws_sns_topic_subscription.oncall_email
+attributes:
+  arn: (known after apply)
+  confirmation_timeout_in_minutes: 1
+  confirmation_was_authenticated: (known after apply)
+  delivery_policy: null
+  endpoint: [email protected]
+  endpoint_auto_confirms: false
+  filter_policy: null
+  filter_policy_scope: (known after apply)
+  id: (known after apply)
+  owner_id: (known after apply)
+  pending_confirmation: (known after apply)
+  protocol: email
+  raw_message_delivery: false
+  redrive_policy: null
+  replay_policy: null
+  subscription_role_arn: null
+  terraform_address: module.api_access[0].aws_sns_topic_subscription.oncall_email
+  terraform_name: module.api_access[0].aws_sns_topic_subscription.oncall_email
+  topic_arn: arn:aws:sns:eu-west-2:540044833068:production-api-alerts

---

💥 Blast Radius

Items 195

Edges 527

[github-actions]

⛔ Auto-Blocked

---

🔴 Decision

Found 1 high risk requiring review

---

📊 Signals Summary

Routine 🔴 -4

---

🔥 Risks Summary

High 1 · Medium 0 · Low 0

---

💥 Blast Radius

Items 195 · Edges 527

---

View full analysis in Overmind ↗