September 19, 2026 路 #3
SSH with a welcome mat
This security group is attached to an admin bastion. What should you change before apply?
resource "aws_security_group" "bastion" {
name = "bastion"
description = "Admin SSH"
vpc_id = aws_vpc.main.id
ingress {
description = "ssh"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = ["0.0.0.0/0"]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}Next puzzle in UTC
One try. The first answer sticks.
How to fix it
0.0.0.0/0 on port 22 invites every scanner on the internet. Limit ingress to the VPN or SSM, and do not rely on a non-standard port as a control.
cidr_blocks = ["0.0.0.0/0"] on port 22 means every address on the internet can attempt a login. Moving SSH to port 2222 does not change that. It only filters the noisiest scanners. Wide egress is a separate question. It is not what makes this group dangerous.
Prefer AWS Systems Manager Session Manager so the instance has no inbound SSH at all. If you still need SSH, the source should be a VPN CIDR, a corporate egress IP, or a prefix list you control. Keep the rule in its own aws_vpc_security_group_ingress_rule so reviews can see the source without reading a nested block.
Fix
ingress {
description = "ssh from the vpn"
from_port = 22
to_port = 22
protocol = "tcp"
cidr_blocks = [var.vpn_cidr]
}
Add a plan-time check, or an OPA policy, that fails the pipeline when port 22 is paired with 0.0.0.0/0 or ::/0.