Security group does not allow ingress from 0.0.0.0/0 or ::/0 to TCP port 22 (SSH)
ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
EC2 security groups are assessed for inbound SSH exposure by locating ingress rules that allow TCP 22 from the Internet (0.0.0.0/0 or ::/0).
Only groups in use are considered; sets already flagged for all-port exposure are not repeated.
Risk
Exposed SSH invites Internet-scale brute force and credential stuffing. A successful login grants remote shell, enabling data theft (confidentiality), code or config tampering (integrity), and cryptomining or service disruption (availability), plus lateral movement within the environment.
prowler aws --checks ec2_securitygroup_allow_ingress_from_internet_to_tcp_port_22
Recommendation
Apply least privilege to SSH:
- Disallow
0.0.0.0/0and::/0; allow only trusted IPs or VPN ranges - Prefer private access via bastion hosts or AWS Systems Manager Session Manager
- Enforce key-based auth, disable passwords, rotate keys
- Add network segmentation and monitoring for defense in depth
Remediation
aws ec2 revoke-security-group-ingress --group-id <SECURITY_GROUP_ID> --protocol tcp --port 22 --cidr 0.0.0.0/0
- In the AWS Console, go to EC2 > Security Groups
- Select the affected security group
- Open the Inbound rules tab
- Delete any rule for port 22 (SSH) with source 0.0.0.0/0 or ::/0
- Click Save rules
Source Code
Resource Type
AwsEc2SecurityGroup