All checks
High
Security groups should not allow ingress from 0.0.0.0/0 or ::/0 to port 3389
Flags security groups that allow TCP ingress from 0.0.0.0/0 or ::/0 to port 3389 (RDP), letting anyone on the internet try to log in to what the group protects. A port range containing 3389 or an All traffic rule counts, as does a managed prefix list holding either CIDR, or a shared one this account can no longer see.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: RDP from the internet stops working once the rule narrows or goes, so set up another way in first, such as Session Manager or a VPN.
In the console
EC2 → Security Groups → the security group → Actions → Edit inbound rules
- Source
- The address ranges that need RDP, not Anywhere-IPv4 or Anywhere-IPv6; or delete the rule
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id>See which of your accounts this check is failing on.
Book a live scan