Default security group permits any rule (should be no-rules)

What it checks

Default security group: at least one ingress or egress rule is declared.

Where it applies

Terraform: aws_default_security_group

CloudFormation: no CloudFormation type maps to these resources yet.

How to fix it

1. Remove all ingress and egress rules from the aws_default_security_group resource (declare it with empty rule blocks).
2. Audit any ENI / instance currently attached to the default SG and migrate to a purpose-built SG.

Frameworks

• AWS FSBP EC2.2
• SOC 2 CC6.1
• SOC 2 CC6.6
• SOC 2 CC6.3
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules