How it works

One finding, start to finish.

Follow PosturaNet as it handles a Security Hub finding for SSH open to the internet. Scroll, and each step plays on the right.

  1. 01

    Finding

    Reads the finding as data. Instructions hidden in finding text are ignored and logged.

    HIGHAWS Security Hub · EC2.19

    Security groups should not allow unrestricted access to ports with high risk

    resourcesg-0a91f3c2account123456789012 · us-east-1ruleingress tcp/22 from 0.0.0.0/0

    Read as data: instructions inside finding text are ignored and logged.

  2. 02

    Locate

    Matches the group in Terraform state, follows the module to file and line, finds the owner.

    terraform statemodule.bastionmodules/bastion/main.tf:5@acme/platform-network
    1resource "aws_security_group" "this" {
2  name   = "bastion"
3  vpc_id = var.vpc_id
4  ingress {
5    cidr_blocks = ["0.0.0.0/0"]
6    from_port   = 22
7    to_port     = 22
  3. 03

    Evidence

    Queries 90 days of VPC flow logs with read-only calls to see who actually connects.

    90 days of VPC flow logs · read-only queries

    CI runnerstcp/22 from 10.0.4.0/24
    0
    VPNtcp/22 from 10.0.9.12/32
    0
    Officetcp/22 from 192.0.2.10/32
    0

    0 other sources on tcp/22 in 90 days

  4. 04

    Contract

    Records the behavior that must keep working. Rare sources are flagged for a human.

    # posturanet/contracts/sg-bastion.yml
resource: module.bastion.aws_security_group.this
evidence: { source: vpc_flow_logs, window: 90d }
must_allow:
  - { proto: tcp, port: 22, from: 10.0.4.0/24 }
  - { proto: tcp, port: 22, from: 10.0.9.12/32 }
  - { proto: tcp, port: 22, from: 192.0.2.10/32 }
must_deny:
  - { proto: tcp, port: 22, from: 0.0.0.0/0 }

    A file your team owns and approves. Rare sources are flagged for a human.

  5. 05

    Fix

    A solver computes the smallest rule set that keeps every must_allow. The LLM never decides.

    modules/bastion/main.tfZ3 · sat · 3 rules
    - cidr_blocks = ["0.0.0.0/0"]
    + cidr_blocks = ["10.0.4.0/24", "10.0.9.12/32", "192.0.2.10/32"]

    The smallest rule set that keeps every must_allow. A solver computes it; the LLM only explains it.

  6. 06

    Validate

    fmt, validate, plan scope, contract invariants and a re-check. All must pass.

    terraform fmt -check
    terraform validate
    plan scope: 1 resource, update in place
    contract: 3/3 must_allow kept, 1/1 must_deny
    EC2.19 re-check passes

    Any failure stops the run. No PR.

  7. 07

    Pull request

    Opens one PR for the owning team. Post-merge verification comes with Team.

    Ready for review+1 −1 · 1 file

    fix(sg): restrict SSH on bastion (EC2.19) #142

    • Evidence 90 days, 99% ENI coverage, confidence high
    • Validation 5 of 5 checks passed
    • Residual risk a source last seen over 90 days ago would lose access

    Review requested from @acme/platform-network

step 1 of 7 · Finding
HIGHAWS Security Hub · EC2.19

Security groups should not allow unrestricted access to ports with high risk

resourcesg-0a91f3c2account123456789012 · us-east-1ruleingress tcp/22 from 0.0.0.0/0

Read as data: instructions inside finding text are ignored and logged.

Example data.

When it stops

“I don't know” beats a confident wrong fix.

If PosturaNet can't be sure who owns a resource or what uses it, it stops, opens no PR, and tells you exactly what's missing.

PosturaNet 0.2.0 · fix · EC2.19 sg-07d2e118
✓ ingest EC2.19 sg-07d2e118 (sg_ingress)
✗ locate module "edge" uses a remote source
– evidence not run
Result STOPPED · no PR opened
Next remote modules arrive in a later release
The pull request

Everything a reviewer needs, in the PR itself.

Ready for reviewfix(sg): restrict SSH on bastion (EC2.19) #142example data
SummaryReplaces 0.0.0.0/0 on tcp/22 with the 3 sources seen in 90 days of flow logs.
EvidenceWindow 90 days, flow log coverage 99% of ENIs, confidence high.
Validationfmt ✓ validate ✓ plan scope 1 resource ✓ contract 3/3 ✓ EC2.19 re-check ✓
Model scopeChecks this security group's ingress rules only, not NACLs or other groups.
Residual riskA source that last connected over 90 days ago would lose access.
After mergeWith Team (coming): PosturaNet re-checks for 24 hours and opens a revert PR on regression.
Try it on your repo →View the source