All checks
Critical
Security groups should not allow unrestricted access to ports with high risk
Flags security groups that allow ingress from 0.0.0.0/0 or ::/0 to a high-risk port (20, 21, 22, 23, 25, 110, 135, 143, 445, 1433, 1434, 3000, 3306, 3389, 4333, 5000, 5432, 5500, 5601, 8080, 8088, 8888, 9200, 9300), which attackers scan for. A port range or All traffic rule reaching one counts, as does a managed prefix list holding either CIDR, or a shared one this account can no longer see.
- service
- EC2
- severity
- Critical
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Security Groups → the security group → Actions → Edit inbound rules
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id>See which of your accounts this check is failing on.
Book a demo