# Ensure the default security group of every VPC restricts all traffic

- Source: https://support.icompaas.com/support/solutions/articles/a_1793292207520267-ensure-the-default-security-group-of-every-vpc-restricts-all-traffic
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [AWS_Checks_v5.39.1](https://support.icompaas.com/support/solutions/c_1793285913477877) › [AWS Checks](https://support.icompaas.com/support/solutions/folders/f_1793287194371224)
- Last updated: 2026-10-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that the default security group of every VPC has no inbound and no outbound rules, including the default self-referencing inbound rule, so that it allows no traffic at all. Resources launched without a specific security group are placed in the default security group, so keeping it empty prevents accidental traffic. Only default security groups of VPCs in use that are attached to at least one network interface are evaluated.

**Rationale**

The default security group allows all traffic between its members and all outbound traffic. Any instance or other resource that falls back to it can therefore communicate widely, which makes lateral movement, port scanning and data exfiltration easier, and unrestricted outbound access can be used for command-and-control traffic. Removing all rules from the default security group, and using dedicated security groups with explicit sources, destinations and ports for each workload, enforces least privilege and reduces the impact of a compromise.

**Impact**

-   Prevents resources from getting broad network access just because no security group was chosen
    
-   Encourages the use of dedicated, least-privilege security groups for each workload
    
-   Resources that currently use the default security group will lose all network connectivity until they are moved to a dedicated security group
    

**Default Value**

Every VPC has a default security group that cannot be deleted. By default it has an inbound rule that allows all traffic from members of the same security group and an outbound rule that allows all outbound IPv4 traffic.

**Pre-Requisites**

-   IAM permissions: ec2:DescribeSecurityGroups, ec2:DescribeNetworkInterfaces, ec2:RevokeSecurityGroupIngress, ec2:RevokeSecurityGroupEgress and ec2:ModifyNetworkInterfaceAttribute
    
-   A list of the resources that currently use the default security group, and dedicated security groups with the rules they need
    

**Remediation**

**Test Plan**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon VPC console and select **Security groups**.
    
3.  Select the security group named default for a VPC.
    
4.  Check the **Inbound rules** and **Outbound rules** tabs.
    
5.  Repeat for each VPC in each region in use.
    
6.  If the default security group is attached to a resource and has any inbound or outbound rule, follow the implementation steps.
    

**CLI:**

List the default security groups with their number of inbound and outbound rules:

aws ec2 describe-security-groups --region <REGION> --filters Name=group-name,Values=default --query "SecurityGroups\[\].\[GroupId,VpcId,length(IpPermissions),length(IpPermissionsEgress)\]" --output table

List the network interfaces that use a default security group:

aws ec2 describe-network-interfaces --region <REGION> --filters Name=group-id,Values=<SECURITY\_GROUP\_ID> --query "NetworkInterfaces\[\].\[NetworkInterfaceId,InterfaceType,Description\]" --output table

A default security group in a VPC that is in use and attached to at least one network interface fails if it has at least one inbound or outbound rule, including the default self-referencing inbound rule. Default security groups with no attached network interface are not evaluated.

**Implementation Steps**

**Console:**

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Move the resources that use the default security group to dedicated security groups with the rules they need.
    
3.  Open the Amazon VPC console and select **Security groups**.
    
4.  Select the security group named default for the affected VPC.
    
5.  On the **Inbound rules** tab, choose **Edit inbound rules**, delete all rules and choose **Save rules**.
    
6.  On the **Outbound rules** tab, choose **Edit outbound rules**, delete all rules and choose **Save rules**.
    
7.  Repeat for each affected VPC in each region in use.
    

**Backout Plan**

Before making changes, save the current rules of the default security group:

aws ec2 describe-security-groups --region <REGION> --group-ids <SECURITY\_GROUP\_ID> > <SECURITY\_GROUP\_ID>-backup.json

To roll back:

1.  Sign in to the AWS Management Console at [https://console.aws.amazon.com](https://console.aws.amazon.com/).
    
2.  Open the Amazon VPC console, select **Security groups** and select the default security group.
    
3.  On the **Inbound rules** and **Outbound rules** tabs, re-add the removed rules using the saved backup (type, protocol, port range and source or destination).
    
4.  Choose **Save rules**.
    

Note: rolling back gives resources in the default security group broad network access again. Use it only as a temporary measure.

**Reference**

-   [https://docs.aws.amazon.com/vpc/latest/userguide/default-security-group.html](https://docs.aws.amazon.com/vpc/latest/userguide/default-security-group.html)
    
-   [https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html](https://docs.aws.amazon.com/config/latest/developerguide/vpc-default-security-group-closed.html)
    
-   [https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html](https://docs.aws.amazon.com/cli/latest/reference/ec2/describe-security-groups.html)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.