Security group has no 0.0.0.0/0 or ::/0 ingress to any port, or is attached only to allowed interface types or instance owners
ec2_securitygroup_allow_ingress_from_internet_to_any_port
EC2 security groups with internet-sourced ingress from 0.0.0.0/0 or ::/0 to any port, and their attachments, are evaluated. Groups linked to network interfaces or instance owners outside an approved list for public exposure are identified.
Risk
Open ingress to any port on non-approved interfaces enables external scanning, brute force, and exploitation of unintended services. This threatens confidentiality (unauthorized access), integrity (tampering), and availability (DoS), and facilitates lateral movement.
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_any_port
Recommendation
Apply least privilege: restrict ingress to required ports and trusted sources; avoid 0.0.0.0/0 and ::/0 except for managed public endpoints. Place workloads behind load balancers, API gateways, or WAFs; use private networking. Allow public rules only on approved interface types.
Remediation
- In the AWS console, go to EC2 > Security Groups
- Select the affected security group
- Open Inbound rules > Edit inbound rules
- Delete any rule with Source 0.0.0.0/0 or ::/0
- Save rules
Source Code
Resource Type
AwsEc2SecurityGroup