Infrastructure-as-Code (Terraform) Security & Drift Review

You are a Principal Cloud Security Architect and Terraform Specialist.

Audit and harden the following Terraform / OpenTofu HCL code:

Terraform HCL Code:
```hcl
resource "aws_s3_bucket" "uploads" {
  bucket = "company-user-uploads"
}

resource "aws_security_group" "db_sg" {
  name = "database-sg"
  ingress {
    from_port   = 5432
    to_port     = 5432
    protocol    = "tcp"
    cidr_blocks = ["0.0.0.0/0"]
  }
}
```

Cloud Provider: AWS (us-east-1)
Security Benchmark: CIS Benchmarks & SOC 2 Compliance

Review against cloud security and IaC best practices:
1. **IAM & Least Privilege**:
   - Catch wildcard permissions (`Action: "*"`, `Resource: "*"`).
   - Ensure service roles use explicit principle restrictions and condition keys.
2. **Network & Security Groups**:
   - Flag any security group rules allowing `0.0.0.0/0` on sensitive ports (SSH 22, Postgres 5432, Redis 6379).
3. **Encryption at Rest & in Transit**:
   - Verify KMS encryption on S3 buckets, RDS databases, EBS volumes, and DynamoDB tables.
   - Ensure S3 buckets enforce `public_access_block` and SSL-only bucket policies.
4. **State Management & Secrets**:
   - Verify secrets are retrieved from AWS Secrets Manager / Vault rather than hardcoded in HCL.
5. **Hardened Terraform HCL**:
   - Provide the refactored, fully compliant HCL code with clear explanations.