[FEAT] EC2/ECS: enforce security group rules on container traffic

Service

EC2 / ECS / VPC

API Action / Feature

Enforce security group ingress/egress on container traffic the way AWS does for ENIs, or document a supported subset (for example published-port filtering only).

Today:

• EC2 security groups are stored and used to decide which ports to publish via socat; CIDR matching is not a real firewall (docs/services/ec2.md).
• ECS awsvpcConfiguration.securityGroups are stored and returned on describe, but never applied to Docker networking / iptables / nftables.
• Local stacks can put wrong CIDRs in Terraform and still “work”; AWS then denies traffic that Floci allowed.

AWS Documentation

• Control traffic with security groups
• Amazon ECS task networking

Why is this needed?

Terraform modules must pass every VPC CIDR that schedules tasks into security group rules. Emulator enforcement (even coarse: drop traffic not matching SG rules between Floci-managed containers) would catch misconfiguration before AWS. Even a documented “control plane only; never enforced” badge on ECS securityGroups would help operators stop treating local green as SG-correct.

Are you willing to contribute a PR?

• Yes
• No