Security group blocks Internet ingress to Postgres port

# Security group with Postgres (5432) not exposed to the Internet
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"] # Critical: avoid 0.0.0.0/0 or ::/0 to prevent Internet exposure
  }
}

# CloudFormation: restrict Postgres (5432) from the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: "<example_resource_name>"
      VpcId: "<example_resource_id>"
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 5432
          ToPort: 5432
          CidrIp: 10.0.0.0/8  # Critical: not 0.0.0.0/0 or ::/0; limits access so 5432 is not open to the Internet