# Ensure there are no Security Groups without ingress filtering being used

- Source: https://support.icompaas.com/support/solutions/articles/62000129467-ensure-there-are-no-security-groups-without-ingress-filtering-being-used
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [IAM Policies](https://support.icompaas.com/support/solutions/folders/62000096130)
- Last updated: 2026-06-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description: 

Ensure there are no Security Groups without ingress filtering being used. Security groups provide stateful filtering of ingress/egress network traffic to AWS resources. It is recommended that no security group allows unrestricted ingress access.

  

Rational:

Any security groups configured to allow unrestricted access can increase opportunities for malicious activity such as hacking, denial-of-service attacks, or brute-force attacks.

  

Impact:

An inbound rule permits instances to receive traffic from the specified IPv4 or IPv6 CIDR address range, or the instances associated with the specified security group.

  

Default Value:

VPC automatically comes with a default security group. If you don't specify a different security group when you launch the instance, the default security group will be associated with the instance. By default, the security group allows all inbound connections. 

  

Pre-requisites:

1.  Sign in as admin or IAM user with required permissions
    
2.  Need at least one security group
    

  

Remediation:

Test Plan:

1.  Sign in to the AWS management console
    
2.  Go to EC2 dashboard at [https://console.aws.amazon.com/ec2](https://console.aws.amazon.com/ec2)
    
3.  Click on security groups in the left navigation pane.
    

4.  Select the security group you want to examine
    
5.  Go to the Inbound tab and make sure at least one rule exist
    

  

Implementation steps:

1.  Sign in to the AWS management console
    
2.  Go to EC2 dashboard at [https://console.aws.amazon.com/ec2](https://console.aws.amazon.com/ec2)
    
3.  Click on security groups in the left navigation pane  
    
4.  Select the security group you want to modify and click on the inbound tab at the bottom  
    
5.  Click on Edit Inbound rules  
    
6.  Click on Add rule and provide the configurations as per your security norms  
    
7.  Click on save rules
    

  

Using AWS CLI

Enables inbound traffic on TCP port 22 (SSH) 

aws ec2 authorize-security-group-ingress \\
    --group-name MySecurityGroup \\
    --protocol tcp \\
    --port 22 \\
    --cidr 203.0.113.0/24

Backout plan:

1.  Sign into the AWS Management Console.
    
2.  Go to EC2 dashboard at [https://console.aws.amazon.com/ec2/](https://console.aws.amazon.com/ec2/).
    
3.  Click on Security Groups, under the NETWORK & SECURITY section, in the left navigation pane
    
4.  Open the security group by clicking on the security group ID
    
5.  Click on Actions dropdown and select Edit inbound rules 
    

6.  Click on Edit inbound rules button and select Type “All traffic”  Protocol “All “ and port range “All” and save it.
    

  

Using AWS CLI:

aws ec2 authorize-security-group-ingress 
 --group-id <value>
  --protocol all
 --port all

Reference:

-   [Security groups for your VPC - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.