security group must have rule for any port about cli HOT 2 CLOSED

Hi!

It might be problematic since "public facing" is something hard to decide. So you need to be careful while setting up this rule, since you might have some "public facing" AWS Resources ( like ELB/ALB/NLB ) and "vpc internal" ones. So checking for all security groups and checking for no "ingress" port would be a problem. Since internal ones will have and they need to pass.

Thus, first you need to identify which security group/aws resource will be public.

I need to check a bit deeper, we might create a BDD test where ;

• Among all the (for e.g.) ELBs, find the ones with Public IP
• Find the Security Groups are used. - not sure about this capability right now, since there is a resource mounting but not sure if it is working for SG -> Resource. Need to check.
• Within that SG, check if there is any Ingress rules defined.

This might require some changes within terraform-compliance like in resource mounting and some enhancements might require to be implemented ( like storing a resource with a custom name that can be used by other tests/scenarios within the same Feature ).

from cli.

There is a workaround introduced with #73, state storing defined in #69 will be in next releases.

from cli.