Firewall rules explicitly allow only necessary CDE traffic

PCI-DSS 4.0 Req 1.2.1 requires that inbound and outbound traffic is restricted to that which is necessary; Req 1.4 prohibits direct public access to any CDE component. A security group with 0.0.0.0/0 on port 22 (SSH) or 5432 (PostgreSQL) means your database is reachable from the entire internet — any brute-force or credential-stuffing attack against it requires only a public IP. CWE-183 (Permissive List of Allowed Inputs) and NIST SC-7 both require deny-by-default firewall posture. A single overly permissive rule can invalidate an otherwise well-segmented network architecture.

Replace every allow-all ingress rule with explicit source security group references or narrowly scoped CIDR blocks. SSH access must be limited to a bastion host security group — never 0.0.0.0/0. Database ports must accept traffic only from the application tier security group.

# Restrict SSH to bastion only
ingress {
  from_port       = 22
  to_port         = 22
  protocol        = "tcp"
  security_groups = [aws_security_group.bastion.id]
}

# Database accessible from app tier only
ingress {
  from_port       = 5432
  to_port         = 5432
  protocol        = "tcp"
  security_groups = [aws_security_group.app.id]
}

Set a deny-all default egress on CDE security groups and add specific outbound rules only for required destinations (e.g., port 443 to payment processor IPs). Audit terraform plan output for any cidr_blocks = ["0.0.0.0/0"] on ports below 1024.