Security group not created using the EC2 Launch Wizard

Check ID: ec2_securitygroup_from_launch_wizard
Provider: AWS
Service: ec2
Severity: MEDIUM
Resource type: AwsEc2SecurityGroup

What this check verifies

EC2 security groups whose names include launch-wizard are identified as created by the EC2 Launch Wizard, distinguishing auto-generated groups from curated, baseline-controlled groups.

Risk

Wizard-generated groups often include overly permissive rules (e.g., 0.0.0.0/0 to admin ports), expanding exposure. Attackers can run port scans and brute-force to gain entry, then lateral movement and data exfiltration, impacting confidentiality and integrity; broad egress aids command-and-control.

Recommendation

Replace or harden these groups. Apply least privilege: restrict inbound to required sources, avoid public admin ports, and minimize egress. Use approved baseline security groups, enforce change control with IaC and guardrails, prefer private administration (bastion or Session Manager), and remove unused rules.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws ec2 delete-security-group —group-id <SECURITY_GROUP_ID>

# Create a security group not named by Launch Wizard
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"  # Critical: name does NOT contain "launch-wizard" to avoid FAIL
  vpc_id = "<example_resource_id>"
}

# CloudFormation: create a security group not named by Launch Wizard
Resources:
  <example_resource_name>:
    Type: AWS::EC2::SecurityGroup
    Properties:
      GroupDescription: SG not created by Launch Wizard
      VpcId: <example_resource_id>
      GroupName: <example_resource_name>  # Critical: name does NOT contain "launch-wizard" to avoid FAIL

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_from_launch_wizard. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires