October 10, 2026 路 #24
Every protocol, every address
The comment says this rule is for the API on port 8080. What does the resource actually allow?
resource "aws_security_group_rule" "api_in" {
type = "ingress"
security_group_id = aws_security_group.api.id
protocol = "-1"
from_port = 0
to_port = 0
cidr_blocks = ["0.0.0.0/0"]
description = "api 8080"
}Next puzzle in UTC
One try. The first answer sticks.
How to fix it
protocol -1 means all protocols. The description is a comment. Set protocol tcp, ports 8080 to 8080, and a source security group instead of the world.
The description is not enforced by AWS. protocol = "-1" is all protocols, and 0.0.0.0/0 is every address. Port fields are ignored for that protocol in the way people hope they are not: this is not "TCP 8080." It is "everything."
Security group rules should name a source you can draw on a diagram. The load balancer's security group is a source. The internet is not, unless the resource is the load balancer itself and the port is the listener.
Fix
protocol = "tcp"
from_port = 8080
to_port = 8080
source_security_group_id = aws_security_group.alb.id
Remove cidr_blocks when the source is a security group. Add a policy test that fails when protocol is -1 outside a known egress rule, and when ingress CIDRs contain 0.0.0.0/0 on a group attached to instances.