# Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to Elasticsearch/Kibana ports - Source: https://support.icompaas.com/support/solutions/articles/62000223607-ensure-no-security-groups-allow-ingress-from-0-0-0-0-0-or-0-to-elasticsearch-kibana-ports - Section: [Solutions](https://support.icompaas.com/support/solutions) › [Security Controls](https://support.icompaas.com/support/solutions/62000065178) › [VPC Policies](https://support.icompaas.com/support/solutions/folders/62000097631) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### **Description:**   A security group acts as a virtual firewall for your instance to control inbound and outbound traffic. When you launch an instance in a VPC, you can assign up to five security groups to the instance. Security groups act at the instance level, not the subnet level. Therefore, each instance in a subnet in your VPC can be assigned to a different set of security groups. ### **Rationale:** Removing unfettered connectivity to remote console services, such as TCP/UDP, reduces a server's exposure to risk. ### **Impact:**  For updating an existing environment, care should be taken to ensure that administrators currently relying on an existing ingress from 0.0.0.0/0 have access to port 5601 through another security group. ### **Default Value:** A VPC comes with a default security group. If you don’t specify a different security group when you launch the instance, the default security group will be associated with the instance. By default, the security group allows all inbound connections. **Pre-Requisite:** - Identify AWS resources that exist within the default security group. - Before implementation steps create a set of least privileged security groups for those resources. - Place the resources in those security group ### **Remediation:** ### **Test plan:** - Sign in to the AWS Management Console  - Navigate to the VPC dashboard at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home%20 "https://console.aws.amazon.com/vpc/home%20")  - In the left navigation,  click on the security group![](https://support.icompaas.com/assets/kb/5e54799c027fafcc.png) - Select the security group to audit - Click on the Inbound Rules tab - Click on the inbound rules tab in the security group.![](https://support.icompaas.com/assets/kb/a38e86aa0e117348.png) - If you find a port 5601  with the source as 0.0.0.0/0 (anywhere) that means traffic to this port is not restricted. To restrict the traffic follow the implementation steps. **Using AWS CLI:** To describe a security group aws ec2 describe-security-groups --group-id **Implementation Steps:** - Log in to the AWS Management Console - Navigate to the VPC dashboard at [https://console.aws.amazon.com/vpc/home](https://console.aws.amazon.com/vpc/home%20 "https://console.aws.amazon.com/vpc/home%20")  - In the left navigation pane, click Security Groups - Select the Security Group that you want to reconfigure.  - Click the Inbound Rules tab from the dashboard bottom panel.![](https://support.icompaas.com/assets/kb/c261a3bef26ac239.png) - Click on the edit inbound rules button ![](https://support.icompaas.com/assets/kb/6ec17f42656a6edb.png)  - For type Kibana Port range 5601 protocol TCP and in the source column remove  0.0.0.0/0 or Anywhere give the least privilege or select my IP. ![](https://support.icompaas.com/assets/kb/3d0cb6a6fc03a0cf.png)  - Click on the Save button.  **Using AWS CLI:** aws ec2 revoke-security-group-ingress --region us-east-1 --group-name MyMSServerSecurityGroup --protocol tcp --port 5601 --cidr 0.0.0.0/0 ### **Backout Plan:** - Sign in to the AWS Management Console. - Navigate to the AWS VPC dashboard at [https://console.aws.amazon.com/vpc/](https://console.aws.amazon.com/vpc/ "https://console.aws.amazon.com/vpc/") - In the navigation panel, under the SECURITY section, choose security group. - Select the Security group that you want to reconfigure. - Select the Inbound Rules tab from the dashboard bottom panel. - Click the Edit button to change the current configuration and revert the changes made. - Save the changes. **Using AWS CLI:** aws ec2 authorize-security-group-ingress --region us-east-1 --group-name MyMSServerSecurityGroup --protocol tcp --port 5601 --cidr 0.0.0.0/0 ### **Reference:** [![](https://support.icompaas.com/assets/kb/d608e79cd739ce8a.png)Authorize inbound traffic for your Windows instances - Amazon Elastic Compute Cloud](https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/authorizing-access-to-an-instance.html)  [![](https://support.icompaas.com/assets/kb/ae452bd51e323650.png)describe-security-groups — AWS CLI 1.22.78 Command Reference](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html) ## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.