Security group must not allow unrestricted ingress (0.0.0.0/0)

Critical AWS General aws-ec2-securitygroup-security-group-allow-unrestr

Applies to

AWS::EC2::SecurityGroup

What CGPulse checks

A resource passes this rule when hasUnrestrictedIngress must equal false. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Remove ingress rules allowing 0.0.0.0/0 or ::/0 and restrict to known IP ranges. In AWS Console: Security Groups > Edit inbound rules > restrict sources. See: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-group-rules.html

CLI

aws ec2 describe-security-groups --group-ids "{id}" --query "SecurityGroups[].IpPermissions"

Terraform

resource "aws_security_group_rule" "{name}" {
  type              = "ingress"
  from_port         = 22
  to_port           = 22
  protocol          = "tcp"
  cidr_blocks       = ["10.0.0.0/8"]  # Restrict to known ranges
  security_group_id = "{id}"
}

Compliance frameworks

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan