Security group does not have all ports open to the Internet

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_all_ports
Provider: AWS
Service: ec2
Severity: CRITICAL
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups with inbound rules permitting Internet sources (0.0.0.0/0, ::/0) to all ports across any protocol

Risk

Opening every port to the Internet enables broad scanning and exploit attempts, leading to unauthorized access, remote code execution, and data exfiltration, with easier lateral movement into the VPC. Confidentiality, integrity, and availability are all at risk.

Recommendation

Enforce least privilege on ingress: allow only required ports from trusted sources, avoid 0.0.0.0/0 and ::/0. Prefer private access (VPN, bastion, or Session Manager), use security group references, and layer defense in depth with network ACLs. Periodically review and remove unused rules.

Remediation

Terraform
Native IaC
Dashboard steps

# Security Group with no inbound rules (prevents all ports open to the Internet)
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  # Critical: no ingress blocks; avoids any rule with protocol "-1" from 0.0.0.0/0 or ::/0
}

# CloudFormation: Security Group without an inbound rule that opens all ports to the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Example SG
      VpcId: <example_resource_id>
      # Critical: Omit SecurityGroupIngress to ensure no rule with IpProtocol "-1" from 0.0.0.0/0 or ::/0 exists,
      # which prevents all ports from being open to the Internet.

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_all_ports. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires