# Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Kafka port 9092 - Source: https://support.icompaas.com/support/solutions/articles/62000223397-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-kafka-port-9092 - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [VPC Policies](https://support.icompaas.com/support/solutions/folders/62000097631) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:** A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups. ### **Rationale:** Removing unfettered connectivity to remote console services reduces a server's exposure to risk.  **Impact:** For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to port 9092 through another security group.  **Default Value** VPC automatically comes with a default security group. If you don’t specify a different security group when you launch the instance, the default security group will be associated with the instance. By default, the security group allows all inbound connections. #### **Pre-Requisite** 1. Make sure you don’t have any default security groups that give access to the Kafka port 2. Sign in as administrator or any IAM user with the required permissions ### ### **Remediation:** **Test Plan:** Perform the following to determine if the account is configured as prescribed:  1. Log in to the AWS Management Console and go to the VPC dashboard at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home%C2%A0 "https://console.aws.amazon.com/vpc/home%C2%A0")  2. In the left navigation, pane click on the **security group![](https://support.icompaas.com/assets/kb/760e4a4a1b562158.png)** 3. Select the security group you want to audit 4. Click on the **Inbound Rules** tab![](https://support.icompaas.com/assets/kb/3eb51d8e6aa46814.png) 5. If you notice, for port 9092 if the source is set to 0.0.0.0/0 or::/0 (Anywhere), it means the selected security group allows unrestricted traffic on port 9092, therefore access to Kafka is open to the public. Follow the implementation steps **Using AWS CLI:** To describe a security group aws ec2 describe-security-groups --group-id ### **Implementation Steps** Perform the following to implement the prescribed state:  1. Log in to the AWS Management Console at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home%C2%A0 "https://console.aws.amazon.com/vpc/home%C2%A0")  2. In the left navigation pane, click **Security Groups** 3. Choose the Security Group that you want to reconfigure 4. Click on the **Inbound Rules** tab for the selected security group![](https://support.icompaas.com/assets/kb/e64fd386790aea78.png) 5. Click on **Edit inbound rules** button![](https://support.icompaas.com/assets/kb/6a805bb91c1d35f3.png) 6. In the source column select the particular IP or range of IPs that you want to allow to access Kafka Port  ![](https://support.icompaas.com/assets/kb/fda578da7fa8e9a8.png)   7. Click on the **Save rules** button **Using AWS CLI:** To modify the security group aws ec2 update-security-group-rule-descriptions-ingress \\ --group-id sg-02f0d35a850ba727f \\ --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=9092,IpRanges='\[{CidrIp=203.0.113.0/16,Description="SSH access from corpnet"}\]' ### **Backout Plan:** If you have any problem after the implementation then follow the implementation step 1-5 and then configure to allow all IPs in the source column and click on the save rule. **Using AWS CLI:** By this command the security group will get pervious rules  aws ec2 update-security-group-rule-descriptions-ingress \\ --group-id sg-02f0d35a850ba727f \\ --ip-permissions IpProtocol=tcp,FromPort=22,ToPort=9092,IpRanges='\[{CidrIp=203.0.113.0/16,Description="SSH access from corpnet"}\]' ### **Reference:** [![](https://support.icompaas.com/assets/kb/6612b60ba4037b65.png)Authorize inbound traffic for your Windows instances - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html)  [![](https://support.icompaas.com/assets/kb/4a7e26e53abd660e.png)Control traffic to resources using security groups - Amazon Virtual Private Cloud](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.