All checks
High
Security groups should only allow unrestricted incoming traffic for authorized ports
Verifies that security groups allow ingress from 0.0.0.0/0 or ::/0, or from a managed prefix list holding either, only on TCP 80 and TCP 443 as single-port rules, since every other port open to the internet is attack surface. A service meant to be public on another port, such as a self-hosted VPN, cannot pass. A shared prefix list this account can no longer see counts as open.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: Internet clients lose access to these ports once the rule narrows or goes, so confirm no service on them is meant to be public first.
In the console
EC2 → Security Groups → the security group → Actions → Edit inbound rules
- Type
- HTTP (TCP 80) or HTTPS (TCP 443), on a rule whose source stays Anywhere-IPv4 or Anywhere-IPv6
- Source
- On every other rule: the address ranges that need it, not Anywhere-IPv4 or Anywhere-IPv6; or delete the rule
With the AWS CLI
aws ec2 revoke-security-group-ingress --group-id <group-id> --security-group-rule-ids <rule-id>See which of your accounts this check is failing on.
Book a live scan