Ensure no security groups allow ingress from 0.0.0.0/0 or ::/0 to port 3389.