Enable security group creation for EC2 instances

[codeparce]

No description provided.

[infracost]

💰 Infracost report

Consider fixing these issues, they don't align with your company's FinOps policies & the Well-Architected Framework.

Cloud security policies
❌ [EC2.9, EC2.25] Amazon EC2 and launch templates should not associate a public IPv4 address EC2 instances and launch templates should not have a public IPv4 address to reduce attack surface and prevent direct internet exposure. Use NAT gateways for outbound connectivity and AWS Systems Manager Session Manager for secure instance access. Corresponds to AWS Security Hub control EC2.9 and EC2.25.
	resource module.ec2.module.ec2_instance["vm1"].aws_instance.this[0] Consider disabling associate_public_ip_address. Set associate_public_ip_address = false and use NAT gateways for outbound connectivity. 🔧 Fix in your IDE — or ask your agent to apply it with Infracost Dev in project aws-test-2_vpc_alb_ec2_lb

Tagging policies
❌ FinOps tags This example Tagging policy shows how you can enforce required FinOps tag keys/values in pull requests. This example checks for the tags 'Service' (can have any value) and 'Environment' (must be Dev/Stage/Prod) on all taggable resources being changed in the pull request. You can adjust it from https://dashboard.infracost.io > Governance > Tagging policies. You have a 14 day trial of this feature as it's part of Infracost Cloud.
	resource module.ec2.module.ec2_instance["vm1"].aws_security_group.this[0] Missing mandatory tag Environment. Must be one of Dev, Stage, Prod. Consider using default tags to avoid adding tags to individual resources. Missing mandatory tag: Service. Consider using default tags to avoid adding tags to individual resources. in project aws-test-2_vpc_alb_ec2_lb
	resource module.ec2.module.ec2_instance["vm1"].aws_vpc_security_group_egress_rule.this["ipv4_default"] Missing mandatory tag Environment. Must be one of Dev, Stage, Prod. Consider using default tags to avoid adding tags to individual resources. Missing mandatory tag: Service. Consider using default tags to avoid adding tags to individual resources. in project aws-test-2_vpc_alb_ec2_lb
	resource module.ec2.module.ec2_instance["vm1"].aws_vpc_security_group_egress_rule.this["ipv6_default"] Missing mandatory tag Environment. Must be one of Dev, Stage, Prod. Consider using default tags to avoid adding tags to individual resources. Missing mandatory tag: Service. Consider using default tags to avoid adding tags to individual resources. in project aws-test-2_vpc_alb_ec2_lb

Monthly estimate generated

Estimate details (includes details of unsupported resources)

Key: * usage cost, ~ changed, + added, - removed

──────────────────────────────────
Key: * usage cost, ~ changed, + added, - removed

*Usage costs can be estimated by updating Infracost Cloud settings, see [docs](https://www.infracost.io/docs/features/usage_based_resources/#infracost-usageyml) for other options.

204 cloud resources were detected:
∙ 28 were estimated
∙ 159 were free
∙ 17 are not supported yet, see https://infracost.io/requested-resources:
  ∙ 11 x aws_subnet
  ∙ 4 x aws_vpc
  ∙ 1 x azurerm_static_web_app
  ∙ 1 x google_firestore_database

---

Let your coding agent remediate these. Infracost Dev gives Cursor, Claude Code and Copilot your FinOps policies and live cloud pricing — so the next PR ships clean.

cost.dev · Setup guide

_{This comment will be updated when code changes.}