I have a aws_directory_service_directory resource defined in a service, which creates a security group that allows ports 1024-65535 to be accessible from 0.0.0.0/0 and this is getting flagged by security hub because AWS CIS standards do not recommend allowing ingress from 0.0.0.0/0 for TCP port 3389.
My question is on how to restrict some of the rules in the resultant security group that gets created by the aws_directory_service_directory resource. How do you remediate this using terraform on a resource that is a by-product of another?