All checks
High
EC2 security groups should not allow ingress from ::/0 to remote server administration ports
Flags EC2 security groups that allow inbound traffic from ::/0 to the SSH (22) or RDP (3389) remote-administration ports. Public IPv6 exposure of these ports is the same risk as IPv4 0.0.0.0/0 exposure (EC2.53) for clients with IPv6. A managed prefix list holding ::/0 counts, as does a shared one this account can no longer see.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
Leave no ingress rule on the security group that reaches port 22 or 3389 from ::/0, or from a managed prefix list holding it, on TCP, on UDP, or on the all-traffic protocol.
In the console
EC2 → Security Groups → the security group → Actions → Edit inbound rules
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id>See which of your accounts this check is failing on.
Book a demo