All checks
High
Security groups should only allow unrestricted incoming traffic for authorized ports
Verifies that security groups allow ingress from 0.0.0.0/0 or ::/0, or from a managed prefix list holding either, only on TCP 80 and TCP 443 as single-port rules, since every other port open to the internet is attack surface. A service meant to be public on another port, such as a self-hosted VPN, cannot pass. A shared prefix list this account can no longer see counts as open.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
EC2 → Security Groups → the security group → Actions → Edit inbound rules
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id>See which of your accounts this check is failing on.
Book a demo