Check ID: ec2_securitygroup_allow_wide_open_public_ipv4
Provider: AWS
Service: ec2
Severity: HIGH
Categories: internet-exposed
Resource type: AwsEc2SecurityGroup

​
What this check verifies

EC2 security groups with rules that permit non-RFC1918 IPv4 ranges wider than /24 are identified across both ingress and egress. The focus is on public CIDRs (/1-/23) that broadly expose sources or destinations, not on private networks.

​
Risk

Over-broad public CIDRs expand exposure and enable:
  • Confidentiality loss via unauthorized access and exfiltration
  • Integrity compromise by exploiting exposed services
  • Availability impact from scanning and abuse
Open egress further allows C2 beacons and bulk data exfiltration to untrusted IPs.

​
Recommendation

Apply least privilege on security groups:
  • Allow only known IPs (prefer /32 or tight CIDRs)
  • Use private connectivity (VPN, Direct Connect, private endpoints)
  • Restrict and log egress; deny by default
  • Segment with security group references and network ACLs for defense-in-depth

​
Remediation

# Terraform: ensure no public IPv4 CIDR wider than /24
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["203.0.113.0/24"] # Critical: /24 (or private RFC1918) avoids wide-open public /1-/23
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_allow_wide_open_public_ipv4. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks