title: Update security group with specific IP range to only allow gitlab-ci to communicate with custom runner
body: <p>I've followed <a href="https://docs.gitlab.com/runner/configuration/runner_autoscale_aws_fargate/" rel="nofollow noreferrer">https://docs.gitlab.com/runner/configuration/runner_autoscale_aws_fargate/</a> to create a custom runner which has a public IP attached and sits in a VPC alongside &quot;private&quot; resources. The runner is used to apply migrations using gitlab ci/cd.</p>
  <p><code>ALLOW 22 0.0.0.0/0</code> has been applied within the security group; but it's wide open to attacks. What IP range do I need to add to only allow gitlab ci/cd runners access via SSH? I've removed that rule for the moment so we're getting connection errors, but the IPs connecting on port 22 all come from AWS (assuming gitlab runners are also on AWS).</p>
  <p>Is there something I'm missing or not understanding?</p>