terraform-aws-s3-bucket VS terraform-aws-security-group

no, we pinned it pretty quickly once v4 of the provider was released https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/pull/136

Sorry, grunt isn't my normal thing, but I get what you're asking now - that's the git version tag. You only need to specify that if you want to pin a tagged version of the repo instead of the master branch. The latest branch is 2.6.0 so you could pin that and specify that version if you wanted https://github.com/terraform-aws-modules/terraform-aws-s3-bucket/tree/v2.6.0

I've got a terraform workspace that has grown very organically. I'm setting my security group rules in a locals definition then calling each type of rule from each of the local values. I've looked into the security group module by Anton but because we have a mixture of CIDRs and Secgroups (as destinations and sources) I do not believe we can leverage it the way it is intended to be.

First of all, I don't much go for stuff like https://github.com/terraform-aws-modules/terraform-aws-security-group, I find it obscures what's actually going on. Where before I just had to learn how AWS works, now I have to learn how AWS and all of these external modules work. Remember, infra-as-code isn't the same as other code-code, the same approaches that work for code-code don't always work for infra-as-code.

Looks good, but there is no such rule named "splunk" but there are 4 of them - https://github.com/terraform-aws-modules/terraform-aws-security-group/blob/master/rules.tf#L139-L142 .