---
checks:
  - code: limit-cidr-ranges
    description: Custom check to ensure the only allowed cidr range are included for ingress
    requiredTypes:
      - resource
    requiredLabels:
      - aws_security_group
    severity: HIGH
    matchSpec:
      name: ingress
      action: isPresent
      subMatch:
        name: cidr_blocks
        action: onlyContains
        value:
          - "1.2.3.4"
          - "5.6.7.8"
    errorMessage: There is a cidr range that is not allowed
    relatedLinks:
      - http://internal.acmecorp.com/standards/aws/networking.html