Security group has no ingress or egress rules with public IPv4 CIDR ranges from /1 to /23
ec2_securitygroup_allow_wide_open_public_ipv4
EC2 security groups with rules that permit non-RFC1918 IPv4 ranges wider than /24 are identified across both ingress and egress.
The focus is on public CIDRs (/1-/23) that broadly expose sources or destinations, not on private networks.
Risk
Over-broad public CIDRs expand exposure and enable:
- Confidentiality loss via unauthorized access and exfiltration
- Integrity compromise by exploiting exposed services
- Availability impact from scanning and abuse
Open egress further allows C2 beacons and bulk data exfiltration to untrusted IPs.
Run this check with Prowler CLI
prowler aws --checks ec2_securitygroup_allow_wide_open_public_ipv4
Recommendation
Apply least privilege on security groups:
- Allow only known IPs (prefer
/32or tight CIDRs) - Use private connectivity (VPN, Direct Connect, private endpoints)
- Restrict and log egress; deny by default
- Segment with security group references and network ACLs for defense-in-depth
Remediation
Native IaC
Terraform
Other
- In the AWS Console, go to VPC > Security Groups
- Select the security group with the finding
- Click Edit inbound rules (and Edit outbound rules if needed)
- For any rule with a public IPv4 CIDR mask /1-/23, delete it or change the CIDR to a private RFC1918 range or to /24 or more specific (e.g., 203.0.113.0/24)
- Save rules
Source Code
Resource Type
AwsEc2SecurityGroup