Check ID: ec2_securitygroup_with_many_ingress_egress_rules
Provider: AWS
Service: ec2
Severity: MEDIUM
Categories: trust-boundaries
Resource type: AwsEc2SecurityGroup

​
What this check verifies

EC2 security groups are evaluated for excessive rule counts, flagging groups where ingress or egress entries exceed the configured threshold (default 50). This targets groups with unusually large rule sets that complicate access control.

​
Risk

Rule sprawl weakens least privilege: large rule sets can hide overly permissive entries, exposing services to the Internet or unintended peers. This enables unauthorized access, data exfiltration, and lateral movement, impacting confidentiality and integrity, and can threaten availability via abuse of exposed services.

​
Recommendation

Apply least privilege and segmentation:
  • Limit rules to required ports, protocols, and sources
  • Split workloads into dedicated security groups per role
  • Prefer SG-to-SG references over broad CIDRs
  • Regularly review, deduplicate, and remove stale rules
  • Layer controls (NACLs, private endpoints) for defense in depth

​
Remediation

# Terraform: Security group with limited number of rules
resource "aws_security_group" "<example_resource_name>" {
  name   = "<example_resource_name>"
  vpc_id = "<example_resource_id>"

  ingress {                      # Critical: keep total ingress/egress rules  50; single rule ensures PASS
    from_port   = 443
    to_port     = 443
    protocol    = "tcp"
    cidr_blocks = ["10.0.0.0/8"]
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = ec2_securitygroup_with_many_ingress_egress_rules. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to AWS checks