security-group ingress filters do not support both OnlyPorts and Cidr

Here’s a sample policy that I’ve been fighting with for the past week with no success:

policies:
  - name: high-risk-security-groups-notify
    resource: security-group
    description: |
      Notifies if any rule from a security group that allows 0.0.0.0/0 
      ingress, not on ports 80 or 443, and notify the user who added the 
      violating rule.
    mode:
        type: cloudtrail
        role: arn:aws:iam::xxx:role/CloudCustodian
        events:
          - source: ec2.amazonaws.com
            event: AuthorizeSecurityGroupIngress
            ids: "requestParameters.groupId"
          - source: ec2.amazonaws.com
            event: AuthorizeSecurityGroupEgress
            ids: "requestParameters.groupId"
          - source: ec2.amazonaws.com
            event: RevokeSecurityGroupEgress
            ids: "requestParameters.groupId"
          - source: ec2.amazonaws.com
            event: RevokeSecurityGroupIngress
            ids: "requestParameters.groupId"
    filters:
        - type: ingress
          OnlyPorts: [80, 443]
          Cidr:
            value: "0.0.0.0/0"
    actions:
      - type: notify
        template: default.html
        priority_header: 1
        subject: "Open Security Group Rule Created-[custodian {{ account }} - {{ region }}]"
        violation_desc: "Security Group(s) Which Had Rules Open To The World:"
        action_desc: |
            "Actions Taken:  The Violating Security Group Rule Violates Our Company's 
            Cloud Policy.  Please Refer To The Cloud FAQ."
        to:
          - event-owner
        transport:
          type: sqs
          queue: https://sqs.us-east-1.amazonaws.com/xxx/cloud-custodian-mailer
          region: us-east-1

I’ve tried using -and when defining the filter conditions, but that didn’t seem to make a difference.

[thomasbiddle]

Notifies if any rule from a security group that allows 0.0.0.0/0 ingress, not on ports 80 or 443, and notify the user who added the violating rule.

So how would this work now after all the changes? Everything I’ve tried breaks in one manner or another.

[kapilt]

the and references in my comments earlier were specific to the internals of the implementation and are configured via match-operator… which defaults to and