Security group blocks Internet ingress to TCP port 22 (SSH)

Check ID: ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups are assessed for inbound SSH exposure by locating ingress rules that allow TCP 22 from the Internet (0.0.0.0/0 or ::/0). Only groups in use are considered; sets already flagged for all-port exposure are not repeated.

Risk

Exposed SSH invites Internet-scale brute force and credential stuffing. A successful login grants remote shell, enabling data theft (confidentiality), code or config tampering (integrity), and cryptomining or service disruption (availability), plus lateral movement within the environment.

Recommendation

Apply least privilege to SSH:

Disallow 0.0.0.0/0 and ::/0; allow only trusted IPs or VPN ranges
Prefer private access via bastion hosts or AWS Systems Manager Session Manager
Enforce key-based auth, disable passwords, rotate keys
Add network segmentation and monitoring for defense in depth

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 revoke-security-group-ingress —group-id <SECURITY_GROUP_ID> —protocol tcp —port 22 —cidr 0.0.0.0/0

# Terraform: restrict SSH from the Internet
resource "aws_security_group" "<example_resource_name>" {
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 22
    to_port     = 22
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]  # Critical: do not use 0.0.0.0/0 or ::/0
  }
}

# CloudFormation: restrict SSH from the Internet
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: Restrict SSH
      VpcId: <example_resource_id>
      SecurityGroupIngress:
        - IpProtocol: tcp
          FromPort: 22
          ToPort: 22
          CidrIp: 10.0.0.0/8  # Critical: allows SSH only from a private range, not 0.0.0.0/0

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires