/**
 * WAW049: Security Group Broad Ingress (any port, except ALB:80/443)
 *
 * Generalizes WAW019 beyond the four named sensitive ports (SSH/RDP/MySQL/
 * Postgres): flags 0.0.0.0/0 or ::/0 ingress on *any* port, with a carve-out
 * for the conventional public ALB listener ports (exactly 80 or 443).
 *
 * Port 80 is exempt unconditionally, not just on a relaxed tier (#917): a
 * public ALB's HTTP listener is meant to be internet-facing on every tier —
 * on the full/production tier it still needs an SG rule open to 0.0.0.0/0 so
 * clients can reach the listener that redirects them to HTTPS (WAW044 is the
 * rule that enforces the redirect actually happens; this rule only judges the
 * SG's shape). The "light" tier serves plaintext HTTP straight off that same
 * port instead of redirecting, which doesn't change the SG's exposure at all.
 * A genuinely over-broad rule (all ports, SSH, etc.) still errors regardless
 * of tier.
 */
import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
export declare function checkBroadIngress(ctx: PostSynthContext): PostSynthDiagnostic[];
export declare const waw049: PostSynthCheck;
//# sourceMappingURL=waw049.d.ts.map