# Ensure security groups do not allow ingress from 0.0.0.0/0 or ::/0 to all ports

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292203820455-ensure-security-groups-do-not-allow-ingress-from-00000-or-0-to-all-ports
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that no Amazon EC2 security group allows inbound traffic from the Internet (0.0.0.0/0 or ::/0) to all ports. A rule of type **All traffic**, or a single-protocol rule (for example TCP or UDP) that covers the whole port range 0-65535, from the Internet exposes every service running on the attached resources. Only security groups that are attached to at least one network interface in a VPC that is in use are evaluated; unattached security groups are not reported.

**Rationale**

Opening every port to the Internet lets anyone scan and attack every service on the attached resources, including services that were never meant to be public. This can lead to unauthorized access, remote code execution and data exfiltration, and makes it easier to move laterally into the VPC. Allowing only the required ports from trusted sources, and using private access through a VPN, bastion host or AWS Systems Manager Session Manager, applies least privilege at the network layer and greatly reduces the attack surface.

**Impact**

-   Prevents Internet access to all services on the attached resources
    
-   Reduces the risk of unauthorized access, exploitation and data exposure
    
-   Clients that rely on the open rule will lose access until specific rules for the required ports and sources are added
    

**Default Value**

A newly created security group has no inbound rules, so all inbound traffic is denied by default. Unrestricted access to all ports exists only if a rule was explicitly added.

**Pre-Requisites**

-   IAM permissions: ec2:DescribeSecurityGroups, ec2:DescribeSecurityGroupRules, ec2:RevokeSecurityGroupIngress and ec2:AuthorizeSecurityGroupIngress
    
-   A list of the ports and trusted CIDR ranges or security groups that legitimately need access to the attached resources
    
-   Confirmation from the application owner that no required client depends on the open rule
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Security Groups** under **Network & Security**.
    
3.  Select a security group that is attached to a resource and open the **Inbound rules** tab.
    
4.  Check for any rule whose source is 0.0.0.0/0 or ::/0 and that either:
    
    -   has type **All traffic**, or
        
    -   has a port range of 0 - 65535.
        
5.  Repeat for each security group in each region in use.
    
6.  If such a rule exists, follow the implementation steps.
    

**CLI:**

List the security groups that have any rule open to the Internet:

aws ec2 describe-security-groups --region <REGION> --filters Name=ip-permission.cidr,Values=0.0.0.0/0 --query "SecurityGroups\[\].GroupId"  
aws ec2 describe-security-groups --region <REGION> --filters Name=ip-permission.ipv6-cidr,Values=::/0 --query "SecurityGroups\[\].GroupId"

For each group returned, list its public inbound rules:

aws ec2 describe-security-group-rules --region <REGION> --filters Name=group-id,Values=<SECURITY\_GROUP\_ID> --query "SecurityGroupRules\[?IsEgress==\\\`false\\\` && (CidrIpv4=='0.0.0.0/0' || CidrIpv6=='::/0')\].\[SecurityGroupRuleId,IpProtocol,FromPort,ToPort,CidrIpv4,CidrIpv6\]" --output table

Check that the group is attached to at least one network interface:

aws ec2 describe-network-interfaces --region <REGION> --filters Name=group-id,Values=<SECURITY\_GROUP\_ID> --query "NetworkInterfaces\[\].NetworkInterfaceId"

A group that is attached to a network interface in a VPC that is in use fails if any public row has protocol -1 (all traffic), or a single protocol with a FromPort of 0 and a ToPort of 65535.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon EC2 console and select **Security Groups** under **Network & Security**.
    
3.  Select the security group found in the Test Plan and open the **Inbound rules** tab.
    
4.  Choose **Edit inbound rules** and delete any rule whose source is 0.0.0.0/0 or ::/0 and that either:
    
    -   has type **All traffic**, or
        
    -   has a port range of 0 - 65535.
        
5.  If access is still needed, choose **Add rule** for each required port and set the source to a trusted IP range or security group.
    
6.  Choose **Save rules**.
    
7.  Repeat for each affected security group in each region in use.
    

**Backout Plan**

Before making changes, save the current inbound rules:

aws ec2 describe-security-group-rules --filters Name=group-id,Values=<SECURITY\_GROUP\_ID> > <SECURITY\_GROUP\_ID>-rules-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Go to **EC2 > Security Groups** and select the security group.
    
3.  In **Inbound rules**, choose **Edit inbound rules**.
    
4.  Re-add the removed rules using the saved backup (protocol, port range and source).
    
5.  Choose **Save rules**.
    

Note: rolling back re-exposes all ports to the Internet. Use it only as a temporary measure while access through trusted sources is arranged.

**Reference**

-   [https://docs.aws.amazon.com/vpc/latest/userguide/VPC\_SecurityGroups.html](https://docs.aws.amazon.com/vpc/latest/userguide/VPC_SecurityGroups.html)
    
-   [https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html](https://docs.aws.amazon.com/vpc/latest/userguide/security-group-rules.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-group-rules.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-group-rules.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.