From 0e65d90ab41871f3a783d368dc6b1dab8786842a Mon Sep 17 00:00:00 2001
From: Platform Automation <platform-automation@company.com>
Date: Fri, 26 Dec 2025 19:21:16 +0000
Subject: [PATCH] security: narrow internal ingress CIDR (JIRA-4521)

---
 main.tf | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/main.tf b/main.tf
index 7b612955..7d3ccc25 100644
--- a/main.tf
+++ b/main.tf
@@ -67,6 +67,11 @@ module "shared_security_group" {
 # Customer API access configuration
 locals {
   api_customer_cidrs = {
+    newco_9 = {
+      cidr = "203.0.113.109/32"
+      name = "NewCo 9"
+    }
+
     newco_8 = {
       cidr = "203.0.113.108/32"
       name = "NewCo 8"
@@ -129,7 +134,7 @@ locals {
     }
   }
 
-  api_internal_cidr = "10.0.0.0/8"
+  api_internal_cidr = "10.0.0.0/16" # SECURITY HARDENING: Narrowed to VPC CIDR per audit findings
   api_domain        = "signals-demo-test.demo"
   api_alert_email   = "alerts@example.com"
 }