# Ensure No EC2 Instances Allow Ingress from the Internet to TCP Port 22(SSH)

- Source: https://support.icompaas.com/support/solutions/articles/62000233550-ensure-no-ec2-instances-allow-ingress-from-the-internet-to-tcp-port-22-ssh-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS Checks New Version](https://support.icompaas.com/support/solutions/62000112673) › [AWS New Checks](https://support.icompaas.com/support/solutions/folders/62000169206)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Profile Applicability: 

Level 2

#### Description

TCP port 22 is used for SSH access, which is a critical management port for EC2 instances. Allowing unrestricted ingress (from 0.0.0.0/0 or ::/0) to this port exposes instances to unauthorized access attempts, such as brute-force attacks. Restricting access to trusted IP ranges or a VPN enhances security and reduces risks.

#### Rationale

-   Enhanced Security: Limits exposure to unauthorized SSH access attempts.
    
-   Risk Mitigation: Reduces potential attack surface for brute-force and other malicious activities.
    
-   Compliance: Aligns with security best practices and regulatory requirements.
    

#### Impact

Pros:

-   Protects instances from unauthorized SSH access attempts.
    
-   Reduces the risk of data breaches and exploits.
    
-   Improves overall security posture.
    

Cons:

-   Requires secure alternatives like VPNs or bastion hosts for remote SSH access.
    
-   Might inconvenience developers if their access IPs frequently change.
    

#### Default Value

By default, security groups may allow unrestricted access to port 22 unless explicitly configured to restrict access.

#### Pre-Requisite

IAM Permissions:

-   ec2:DescribeSecurityGroups
    
-   ec2:RevokeSecurityGroupIngress
    
-   AWS CLI installed and configured.
    

#### Remediation

Test Plan: Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the EC2 Dashboard.
    
3.  Go to the Security Groups tab.
    
4.  Identify security groups allowing ingress to port 22 from 0.0.0.0/0 or ::/0.
    

Using AWS CLI:

Identify Ingress Rules Allowing Public Access:

aws ec2 describe-security-groups --query "SecurityGroups\[\*\].IpPermissions\[?FromPort==\`22\` && (contains(IpRanges\[\].CidrIp, '0.0.0.0/0') || contains(Ipv6Ranges\[\].CidrIpv6, '::/0'))\]"

Implementation Steps: Using AWS Console:

1.  Sign in to the AWS Management Console.
    
2.  Navigate to the EC2 Dashboard.  
    ![](https://support.icompaas.com/assets/kb/7aa51251c47ec6a7.png)
    
3.  Go to the Security Groups tab.  
    ![](https://support.icompaas.com/assets/kb/419023157ff36ffa.png)
    
4.  Identify security groups with rules allowing ingress to port 22.  
    ![](https://support.icompaas.com/assets/kb/1eac0801452d3072.png)
    
5.  Edit the security groups:
    
    -   Remove the rule allowing ingress from 0.0.0.0/0 or ::/0.
        
    -   Restrict access to trusted IP ranges, or remove the rule entirely if SSH is not required.  
        ![](https://support.icompaas.com/assets/kb/afea5fbfdd25f0bf.png)
        
6.  Save the changes.
    

Using AWS CLI:

Revoke Insecure Ingress Rules:  

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 22 --cidr 0.0.0.0/0

aws ec2 revoke-security-group-ingress --group-id <security-group-id> --protocol tcp --port 22 --cidr ::/0

Add Secure Rules for Specific IP Ranges (if SSH access is required):

aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol tcp --port 22 --cidr <trusted-cidr>

  

#### Backout Plan

Using AWS Console:

1.  Re-enable access by adding specific ingress rules as needed.
    
2.  Monitor the access and ensure it complies with security policies.
    

Using AWS CLI:

Restore Required Access:

aws ec2 authorize-security-group-ingress --group-id <security-group-id> --protocol tcp --port 22 --cidr <specific-cidr>

#### References

-   [AWS Security Best Practices for EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/security-groups.html)
    
-   [Mitigating Unauthorized Access Risks for SSH](https://docs.aws.amazon.com/general/latest/gr/aws-security-best-practices.html)
    
-   [AWS CLI - Security Group Rules](https://docs.aws.amazon.com/cli/latest/reference/ec2/)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.