Security group allows unrestricted ingress on all ports from the internet

What it checks

Security group allows unrestricted ingress on all ports from the internet

Where it applies

Terraform: aws_security_group, aws_security_group_rule

CloudFormation: AWS::EC2::SecurityGroup

How to fix it

1. Remove the protocol = -1 ingress rule. Replace with explicit per-service rules — only the ports your application actually listens on, with the narrowest CIDR possible.
2. Use Security Manager Session Manager instead of SSH (port 22) to eliminate the SSH attack surface entirely.

Frameworks

• AWS FSBP EC2.19
• SOC 2 CC6.6
• HIPAA 164.312(a)(1)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules