Skip to content

Annual Firewall Rule Review — 2026

Purpose. The yearly review of every network access rule in the AWS production account that the Cloud & Infrastructure Security Policy (ISMS-DOC-A08-20-1) asks for. Each rule is checked for whether it is still needed and as narrow as it can be. Day to day, rules change only through pull requests to SoonHQ/soon-terraform, and CHK-NET-01 flags anything open to the internet. This review also covers the rules that code does not manage.

1. Scope and method
Account / region 742816139593 (production), eu-west-1
What was read All 32 security groups, all 24 network interfaces, both RDS instances, the VPC route tables and peering connections. Read-only API calls, output filed as evidence (row 46)
Date 21 October 2026 (rules first exported 8 September 2026)
Prepared by ISMS, from the read-only output
Reviewer Thomas Picauly (CTO). Signs off the decisions in §3

For each group the review asks: is it attached to anything? Is each inbound rule needed? Is its source the narrowest that works (another security group rather than an address range)?

2. What is in order

  • Production load balancer (soon-server-production-sg-alb-prod): 80 and 443 from anywhere. Needed: it is the public entry point. TLS 1.2+ only.
  • Production database (rds-soon-soon-prod): not publicly accessible, encrypted, Multi-AZ, 30-day backups. Port 3306 is open to the production service tasks' security group.
  • Development (soon-vpc-dev): the database accepts 3306 from inside the development VPC only; tasks accept their port from the development load balancer's security group only. Development has no network path to production.
  • No running EC2 instances. Nothing in the account has SSH open on a live machine.

3. Findings and decisions

# Finding Risk Decision / action Owner Due
1 soon-server-production-sg-task-prod, attached to the two running production API tasks, allows port 4040 from 0.0.0.0/0 and ::/0. Not reachable from the internet: the tasks are in private subnets, with no public IP and no IPv6, and leave through NAT. But any host in the production VPC or the peered default VPC could reach them directly, bypassing the load balancer Low Restrict the inbound rule to the load balancer's security group (sg-048050d51c710c2f0) in OpenTofu, as modules/fargate-service already does in development Thomas TODO(Thomas): date
2 The production database is in the default VPC (172.31.0.0/16), reached from production over the peering connection soon-prod-app-to-default-rds, not in the production VPC's private subnets. The default VPC's subnets route to an internet gateway, so the only thing keeping the database off the internet is PubliclyAccessible = false Medium S-299 removed the public endpoint in August 2026 (ISMS-DOC-A05-37-1 §3), which is the control that matters. Keep PubliclyAccessible = false monitored (CHK-NET-01). TODO(Thomas): decide whether to move the database into private subnets of the production VPC, and if so, when Thomas TODO(Thomas)
3 The database's security group (secgrp-rds-soon-soon-prod) still allows 3306 from four public addresses (77.164.252.120, 54.74.20.76, 63.35.77.161, 52.212.176.206). None can connect while the database has no public endpoint, but they are leftovers and would become live exposure if that setting ever changed Low Remove the four address ranges, keeping only the service tasks' security group Thomas TODO(Thomas): date
4 Nine security groups attached to nothing still have rules open to the internet: mjssh (all traffic), gpkvk (80, 443, 4466, SSH over IPv6), rds-launch-wizard-1/3/4, Database2-test, Production-DB-SG (all MySQL 3306), soon-server-sg-alb-development, soon-server-sg-task-development Low (unused) Delete them, so they cannot be attached to something by mistake. This is the outstanding housekeeping step of S-299 (ISMS-DOC-A05-37-1 §3 step 5) Thomas TODO(Thomas): date
5 A development load balancer (soon-seer-alb-dev, 80 from anywhere, two public IPs) and development task groups for the solver (soon-seer-*-dev) are in the production VPC Low Move the development solver to the development VPC, or remove it if unused. TODO(Thomas): what does soon-seer-alb-dev serve? Thomas TODO(Thomas)
6 Two VPCs appear to be unused: 172.30.0.0/16 (no name) and soon-server-vpc-development (10.0.0.0/16, the same range as production). They hold only unattached groups Low Confirm they are unused, then delete them Thomas TODO(Thomas)

Findings 2 and 5 correct the network diagram (ISMS-DOC-A08-22-1), which placed the database in the production VPC's private subnets and showed no peering.

4. Sign-off

Reviewed by Thomas Picauly (CTO): decisions above accepted, with the due dates filled in. Approval of this record by the ISM is the date of the review's completion.

Change log

Version Date Author Change
0.1 2026-10-21 ISMS First annual review, from the read-only AWS output of 21 Oct 2026. Six findings, none reachable from the internet; for Thomas to set dates and sign off.