GUARDRAIL "[CIS - AWS] 5.1.2 Ensure CIFS access is restricted to trusted networks to prevent unauthorized access"
  WHEN aws_security_group_rule.type = "ingress" AND aws_security_group_rule.protocol IN ["tcp", "6", "all", "-1"] AND (aws_security_group_rule.from_port = -1 AND aws_security_group_rule.to_port = -1)
    REQUIRE EVERY cidr_blocks NOT IN ["0.0.0.0/0", "::/0"]
  WHEN aws_security_group.ingress AND aws_security_group.ingress.protocol IN ["tcp", "6", "all", "-1"] AND (aws_security_group.ingress.from_port = -1 AND aws_security_group.ingress.to_port = -1)
    REQUIRE EVERY ingress.cidr_blocks NOT IN ["0.0.0.0/0", "::/0"]
  WHEN aws_security_group_rule.type = "ingress" AND aws_security_group_rule.protocol IN ["tcp", "6", "all", "-1"] AND (aws_security_group_rule.from_port <= 445 AND aws_security_group_rule.to_port >= 445)
    REQUIRE EVERY cidr_blocks NOT IN ["0.0.0.0/0", "::/0"]    
  WHEN aws_security_group.ingress AND aws_security_group.ingress.protocol IN ["tcp", "6", "all", "-1"] AND (aws_security_group.ingress.from_port = 445 AND aws_security_group.ingress.to_port = 445)
    REQUIRE EVERY ingress.cidr_blocks NOT IN ["0.0.0.0/0", "::/0"]
  OVERRIDE WITH APPROVAL @security