LLCREATIVITY LLC / TZUR IMPACT / LOCAL REVIEW

AWS::EC2::SecurityGroup supplied snapshot comparison

Synthetic demonstration. This report traces supplied relationships. It does not establish an incident, mission outage, compliance or authorization decision.

2 connected systems · 3 mapped controls · 3 evidence gaps

01 / What changed

Source: AWS Config · Observed: 2026-10-13T09:00:00Z

Technical severity: HIGH. A supplied ingress rule newly permits 0.0.0.0/0 or ::/0 for its protocol/port tuple. This does not prove reachability, exploitation or mission failure.

MODIFIED /ipPermissions

Before

[
  {
    "ipProtocol": "tcp",
    "fromPort": 443,
    "toPort": 443,
    "ipRanges": [
      {
        "cidrIp": "10.20.0.0/16"
      }
    ]
  }
]

After

[
  {
    "ipProtocol": "tcp",
    "fromPort": 443,
    "toPort": 443,
    "ipRanges": [
      {
        "cidrIp": "0.0.0.0/0"
      }
    ]
  }
]

02 / Which systems need investigation

Benefits Processing

Mission: Citizen Benefits · Review priority 100/100

GovCloud application security group protects Benefits API instance
Benefits API instance supports Benefits Processing

Accountable owners

Benefits System Owner

Mapped controls

SC-7 Boundary Protection
IA-2 Identification and Authentication

Authorization records

DEMO-ATO-014

Claims Analytics

Mission: Program Analytics · Review priority 84/100

GovCloud application security group protects Benefits database
Benefits database supports Claims Analytics

Accountable owners

Not mapped. Further evidence is required.

Mapped controls

AU-2 Event Logging

Authorization records

Not mapped. Further evidence is required.

03 / Evidence gaps

Claims Analytics: missing accountable owner — No accountable owner is reachable inside this system's supplied dependency boundary.
Claims Analytics: missing authorization record — No authorization record is reachable inside this system's supplied dependency boundary.
No authorization comparison supplied — Mapped controls are not proof that control implementation changed.

Supplied directed graph only. One shortest path to each affected system; not exhaustive path discovery. Owner/control/authorization checks stop at other system boundaries. Source references are supplied strings, not fetched or authenticated.

Mapping age relative to the supplied change timestamp, not today. Thirty days is an illustrative review threshold, not a federal requirement.

04 / Authorization evidence comparison

No paired authorization snapshots supplied. Configuration comparison does not invent control evidence.

05 / Human disposition

Print this report or complete the accompanying disposition template within your approved review process. This runner does not verify reviewer identity or issue authorization.

Reviewer
Date
Disposition
Rationale / further evidence

06 / Provenance

Input SHA-256

5aee5091f89c1582aafbfd9209de79a7402f7edea118868793ef384a429eb6a5

Engine: tzur-impact-rule-engine/0.5. A hash detects changes against a trusted copy; it does not authenticate origin. Full inputs, results and the file manifest accompany this report.