🔒 security: 8080 포트 외부 노출 제거

[catturtle123]

Summary

• Security Group에서 8080 포트 ingress 규칙 제거
• Nginx 리버스 프록시를 통해 내부에서만 8080 접근

Changes

Before	After
22, 80, 443, 8080 열림	22, 80, 443만 열림

Reason

• 8080 포트 직접 노출 시 Nginx 우회 가능
• 보안 강화를 위해 80/443만 외부에 노출

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Review was skipped due to path filters

⛔ Files ignored due to path filters (1)

• ci/terraform/security_groups.tf is excluded by none and included by none

CodeRabbit blocks several paths by default. You can override this behavior by explicitly including those paths in the path filters. For example, including **/dist/** will override the default block on the dist directory, by removing the pattern from both the lists.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• 🔍 Trigger a full review

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch ci/remove-8080-port

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[github-actions]

Terraform Format 🖌 failure

Terraform Init ⚙️ success

Terraform Validate 🤖 success

Terraform Plan 📖 success

Show Plan

Acquiring state lock. This may take a few moments...
data.aws_route53_zone.main: Reading...
data.aws_ami.ubuntu_2404: Reading...
aws_vpc.main: Refreshing state... [id=vpc-06e337fe8c72d274b]
aws_dynamodb_table.terraform_lock: Refreshing state... [id=web-team-3-tf-lock-v2]
aws_db_parameter_group.main: Refreshing state... [id=web-team-3-dev-mysql8-params]
aws_s3_bucket.terraform_state: Refreshing state... [id=web-team-3-tf-state-v2]
data.aws_route53_zone.main: Read complete after 0s [id=Z093699513LDAGIAMRGKU]
data.aws_ami.ubuntu_2404: Read complete after 1s [id=ami-0130d8d35bcd2d433]
aws_route_table.private: Refreshing state... [id=rtb-0355eb582b4ff3dd2]
aws_subnet.private[0]: Refreshing state... [id=subnet-007a290b1fdb51067]
aws_subnet.private[1]: Refreshing state... [id=subnet-02884b8d343ff25a5]
aws_subnet.public[1]: Refreshing state... [id=subnet-07e38fbb8cfadc882]
aws_internet_gateway.main: Refreshing state... [id=igw-0e141727ecff126ee]
aws_subnet.public[0]: Refreshing state... [id=subnet-0efa7ca9b8d1e451d]
aws_security_group.ec2: Refreshing state... [id=sg-0b5c350188ea252e5]
aws_s3_bucket_public_access_block.terraform_state: Refreshing state... [id=web-team-3-tf-state-v2]
aws_s3_bucket_versioning.terraform_state: Refreshing state... [id=web-team-3-tf-state-v2]
aws_s3_bucket_server_side_encryption_configuration.terraform_state: Refreshing state... [id=web-team-3-tf-state-v2]
aws_route_table.public: Refreshing state... [id=rtb-0dad63dad02ddc5ff]
aws_security_group.rds: Refreshing state... [id=sg-03705313b48995086]
aws_route_table_association.private[1]: Refreshing state... [id=rtbassoc-0d27850a8a6e94ba5]
aws_route_table_association.private[0]: Refreshing state... [id=rtbassoc-06218dad0b08de21c]
aws_db_subnet_group.main: Refreshing state... [id=web-team-3-dev-db-subnet-group]
aws_instance.app: Refreshing state... [id=i-09f54da883306a39e]
aws_route_table_association.public[0]: Refreshing state... [id=rtbassoc-099953f254a4d5809]
aws_route_table_association.public[1]: Refreshing state... [id=rtbassoc-03c01253dea21ea7b]
aws_db_instance.main: Refreshing state... [id=db-CDWN44WOQ6PTQFDBPY6KNBS2ME]
aws_eip.app: Refreshing state... [id=eipalloc-0b8749a716be29355]
aws_route53_record.api: Refreshing state... [id=Z093699513LDAGIAMRGKU_api.moaofficial.kr_A]

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place

Terraform will perform the following actions:

  # aws_security_group.ec2 will be updated in-place
  ~ resource "aws_security_group" "ec2" {
        id                     = "sg-0b5c350188ea252e5"
      ~ ingress                = [
          - {
              - cidr_blocks      = [
                  - "0.0.0.0/0",
                ]
              - description      = "Application port"
              - from_port        = 8080
              - ipv6_cidr_blocks = []
              - prefix_list_ids  = []
              - protocol         = "tcp"
              - security_groups  = []
              - self             = false
              - to_port          = 8080
            },
            # (3 unchanged elements hidden)
        ]
        name                   = "web-team-3-dev-ec2-sg"
        tags                   = {
            "Name" = "web-team-3-dev-ec2-sg"
        }
        # (7 unchanged attributes hidden)
    }

Plan: 0 to add, 1 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Note: You didn't use the -out option to save this plan, so Terraform can't
guarantee to take exactly these actions if you run "terraform apply" now.

Pushed by: @catturtle123, Action: pull_request