const allowPostgresSgRule =
      env === 'prod' &&
      tfCCCRdsPostgresSg &&
      new aws.ec2.SecurityGroupRule('ccc-postgres-access-rule', {
        type: 'ingress',
        fromPort: 5432,
        toPort: 5432,
        protocol: 'tcp',
        sourceSecurityGroupId: sg.id,
        securityGroupId: tfCCCRdsPostgresSg.id,
      });
   // NOTE: Sunguard GP VPN
   const allowLocalAccessGPSgRule = new aws.ec2.SecurityGroupRule('allow-gp-access-rule', {
    type: 'ingress',
    fromPort: 5432,
    toPort: 5432,
    protocol: 'tcp',
    cidrBlocks: ['XXX.XX.0.0/19'],
    securityGroupId: XXXXXRdsPostgresSg.id,
  });
  // NOTE: Bethpage GP VPN
  const allowLocalAccessGPBPSgRule = new aws.ec2.SecurityGroupRule('allow-gp-bp-access-rule', {
    type: 'ingress',
    fromPort: 5432,
    toPort: 5432,
    protocol: 'tcp',
    cidrBlocks: ['XXX.XX.X.0/24'],
    securityGroupId: XXXXRdsPostgresSg.id,
  });

allowPostgresSgRule