Security group has 50 or fewer inbound rules and 50 or fewer outbound rules
ec2_securitygroup_with_many_ingress_egress_rules
EC2 security groups are evaluated for excessive rule counts, flagging groups where ingress or egress entries exceed the configured threshold (default 50). This targets groups with unusually large rule sets that complicate access control.
Risk
Rule sprawl weakens least privilege: large rule sets can hide overly permissive entries, exposing services to the Internet or unintended peers. This enables unauthorized access, data exfiltration, and lateral movement, impacting confidentiality and integrity, and can threaten availability via abuse of exposed services.
prowler aws --checks ec2_securitygroup_with_many_ingress_egress_rules
Recommendation
Apply least privilege and segmentation:
- Limit rules to required ports, protocols, and sources
- Split workloads into dedicated security groups per role
- Prefer SG-to-SG references over broad CIDRs
- Regularly review, deduplicate, and remove stale rules
- Layer controls (NACLs, private endpoints) for defense in depth
Remediation
- In the AWS console, go to EC2 > Security Groups
- Select the security group that FAILED
- In Inbound rules, click Edit inbound rules
- Delete rules until the inbound rule count is 50 or fewer, then Save
- In Outbound rules, click Edit outbound rules
- Delete rules until the outbound rule count is 50 or fewer, then Save
Source Code
Resource Type
AwsEc2SecurityGroup