Caution

[High Risk] Cross-VPC fraud-ingest traffic to the 9090 backend will be blocked by the narrowed security-group CIDR

The change narrows ingress on the shared internal-services security group from 10.0.0.0/8 to 10.0.0.0/16 for ports 8080, 443, and 9090. That security group is attached to the production API instance at 10.0.101.34, and the blast radius shows this instance is the healthy backend for the txn-feed-terraform-example target group on port 9090. The load balancer and its subnets are in a different VPC with CIDR 10.50.0.0/16, so its source addresses are currently permitted by 10.0.0.0/8 but will be excluded by 10.0.0.0/16.

Once applied, traffic from the fraud-detection VPC to 10.0.101.34:9090 will be blocked at the instance security group. That will cause the NLB target’s health checks and data-plane connections to fail, making the registered backend unhealthy and breaking the internal fraud-ingest / regulated transaction feed path for cross-VPC consumers.
_{View reasoning tree here.}