Security / Public reference

Joined value is public

A join or Fn::Join of known literals that results in 0.0.0.0/0 or ::/0.

What you need to supply

The separator and every list element must be literals or already-resolved references. An unknown element leaves the value unresolved.

If it reports a finding

High severity. The suggested next step is to replace the joined public range with an approved range.

What this does not prove

A joined 10.0.0.0/24 is not this finding. cidrsubnet and coalesce stay unresolved. The same value is not reported twice on the same argument.

Join that this check is written to notice

variable "a" {
  default = "0.0.0.0"
}
variable "b" {
  default = "0"
}
resource "aws_security_group" "web" {
  ingress {
    cidr_blocks = [join("/", [var.a, var.b])]
  }
}

All review checks. Reading this page does not submit your infrastructure.