All checks
Critical
Security groups should not allow unrestricted access to ports with high risk
Flags security groups that allow TCP ingress from 0.0.0.0/0 or ::/0 to a high-risk port (20, 21, 22, 23, 25, 110, 135, 143, 445, 1433, 1434, 3000, 3306, 3389, 4333, 5000, 5432, 5500, 5601, 8080, 8088, 8888, 9200, 9300), which attackers scan for. A port range or All traffic rule reaching one counts, as does a managed prefix list holding either CIDR, or a shared one this account can no longer see.
- service
- EC2
- severity
- Critical
- scope
- evaluated in every region
How to fix it
- Can break clients: Internet clients lose access to these ports once the rule narrows or goes, so confirm none is meant to be public and give admins another way in first, such as Session Manager.
In the console
EC2 → Security Groups → the security group → Actions → Edit inbound rules
- Source
- The address ranges that need the port, not Anywhere-IPv4 or Anywhere-IPv6; or delete the rule
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id>See which of your accounts this check is failing on.
Book a live scan