Check ID: ec2_securitygroup_default_restrict_traffic
Provider: AWS
Service: ec2
Severity: HIGH
Categories: trust-boundaries, internet-exposed
Resource type: AwsEc2SecurityGroup

​
What this check verifies

Default VPC security group should have no inbound or outbound rules. This evaluates whether the group allows any traffic-ingress, egress, or self-referencing-instead of remaining empty.

​
Risk

Permissive rules in the default security group mean instances that inherit it can communicate widely. This enables lateral movement, port scanning, and data exfiltration; unrestricted egress aids C2. Confidentiality and integrity are reduced, and the blast radius of a compromise grows.

​
Recommendation

Enforce least privilege: keep the default group empty by removing all ingress and egress rules. Use dedicated security groups per workload with explicit sources, destinations, and ports. Regularly review for broad CIDRs like 0.0.0.0/0 and apply defense in depth via automation and policy guardrails.

​
Remediation

resource "aws_default_security_group" "<example_resource_name>" {
  vpc_id = "<example_vpc_id>"

  ingress = []  # Critical: removes all inbound rules from the default SG
  egress  = []  # Critical: removes all outbound rules from the default SG
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_default_restrict_traffic. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks