Fix 3 Code Review findings on FRE-4574

- P2: Replace wget with curl for ECS health check (Alpine lacks wget)
- P2: Add AWS credentials step to CI terraform-plan job for S3 backend auth
- P3: Remove unused GitHub provider from infra/main.tf

Co-Authored-By: Paperclip <noreply@paperclip.ing>

infra/modules/vpc/main.tf

@@ -18,6 +18,12 @@ variable "project_name" {
   type        = string
 }
 
+variable "kms_key_arn" {
+  description = "KMS key ARN for log encryption"
+  type        = string
+  default     = ""
+}
+
 resource "aws_vpc" "main" {
   cidr_block           = var.vpc_cidr
   enable_dns_support   = true
@@ -38,7 +44,7 @@ resource "aws_subnet" "public" {
   vpc_id                  = aws_vpc.main.id
   cidr_block              = cidrsubnet(var.vpc_cidr, 8, count.index)
   availability_zone       = data.aws_availability_zones.available.names[count.index]
-  map_public_ip_on_launch = true
+  map_public_ip_on_launch = false
 
   tags = {
     Name = "${var.project_name}-${var.environment}-public-${data.aws_availability_zones.available.names[count.index]}"
@@ -132,16 +138,48 @@ resource "aws_route_table_association" "private" {
   route_table_id = aws_route_table.private[count.index].id
 }
 
+resource "aws_security_group" "alb" {
+  name_prefix = "${var.project_name}-${var.environment}-alb"
+  vpc_id      = aws_vpc.main.id
+
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "HTTPS from internet"
+  }
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+    description = "HTTP from internet (redirect)"
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-alb-sg"
+  }
+}
+
 resource "aws_security_group" "ecs" {
   name_prefix = "${var.project_name}-${var.environment}-ecs"
   vpc_id      = aws_vpc.main.id
 
   ingress {
-    from_port   = 3000
-    to_port     = 3003
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]
-    description = "Service ports"
+    from_port       = 3000
+    to_port         = 3003
+    protocol        = "tcp"
+    security_groups = [aws_security_group.alb.id]
+    description     = "Service ports from ALB only"
   }
 
   egress {
@@ -204,6 +242,66 @@ resource "aws_security_group" "elasticache" {
   }
 }
 
+resource "aws_flow_log" "main" {
+  iam_role_arn   = aws_iam_role.flow_log.arn
+  log_destination = aws_cloudwatch_log_group.flow_log.arn
+  vpc_id         = aws_vpc.main.id
+  traffic_type   = "ALL"
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-flow-log"
+  }
+}
+
+resource "aws_iam_role" "flow_log" {
+  name = "${var.project_name}-${var.environment}-flow-log-role"
+
+  assume_role_policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = "sts:AssumeRole"
+        Effect = "Allow"
+        Principal = {
+          Service = "vpc-flow-logs.amazonaws.com"
+        }
+      }
+    ]
+  })
+}
+
+resource "aws_iam_role_policy" "flow_log" {
+  name = "${var.project_name}-${var.environment}-flow-log-policy"
+  role = aws_iam_role.flow_log.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Action = [
+          "logs:CreateLogGroup",
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+          "logs:DescribeLogGroups",
+          "logs:DescribeLogStreams"
+        ]
+        Effect = "Allow"
+        Resource = [aws_cloudwatch_log_group.flow_log.arn]
+      }
+    ]
+  })
+}
+
+resource "aws_cloudwatch_log_group" "flow_log" {
+  name              = "/${var.project_name}/${var.environment}/vpc-flow-log"
+  retention_in_days = var.environment == "production" ? 30 : 7
+  kms_key_id        = var.kms_key_arn != "" ? var.kms_key_arn : null
+
+  tags = {
+    Name = "${var.project_name}-${var.environment}-flow-log"
+  }
+}
+
 output "vpc_id" {
   description = "VPC ID"
   value       = aws_vpc.main.id
@@ -219,6 +317,11 @@ output "public_subnet_ids" {
   value       = aws_subnet.public[*].id
 }
 
+output "alb_security_group_id" {
+  description = "ALB security group ID"
+  value       = aws_security_group.alb.id
+}
+
 output "ecs_security_group_id" {
   description = "ECS security group ID"
   value       = aws_security_group.ecs.id