Security group permits 0.0.0.0/0 on a known debug or management port

What it checks

Security group: ingress allows 0.0.0.0/0 on a known debug/management port (e.g., 8080 / 5432 / 9200 / 6379).

Where it applies

Terraform: aws_security_group, aws_security_group_rule

CloudFormation: AWS::EC2::SecurityGroup

How to fix it

1. Replace 0.0.0.0/0 with a corporate egress CIDR list, an SG-to-SG reference, or move the port behind a VPN/SSM tunnel.
2. If the port truly needs internet exposure (rare), front it with a CloudFront/ALB + WAF + auth.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules