Security group does not have any port open to a specific public IP address
ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip
EC2 security groups with inbound rules allowing traffic from specific globally routable IP addresses to any port or protocol. Wildcard CIDRs (0.0.0.0/0 and ::/0) are excluded as they are covered by the related checks. This targets cases where developers add personal or third-party IPs directly to security groups.
Risk
Ingress rules with specific public IPs can become stale when personnel change or access requirements expire. An attacker with compromised AWS credentials could also add narrow IP rules to gain access on any port, bypassing checks that only look for 0.0.0.0/0 or ::/0.
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_any_port_from_ip
Recommendation
Review all security group rules with specific public IP sources. Remove stale entries for former employees or expired access. Use VPN, AWS Systems Manager Session Manager, or AWS Client VPN instead of direct IP-based access. For third-party integrations, use VPC endpoints or AWS PrivateLink where possible.
Remediation
- In the AWS Console, go to EC2 > Security Groups
- Select the affected security group
- Open the Inbound rules tab and click Edit inbound rules
- Remove or restrict any rule with a Source that is a public IP address
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup
Related To
- ec2_securitygroup_allow_ingress_from_internet_to_all_ports
- ec2_securitygroup_allow_ingress_from_internet_to_any_port